ET ATTACK_RESPONSE Inbound PowerShell Checking for Virtual Host (Win32_DiskDevice WMI)

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET ATTACK_RESPONSE Inbound PowerShell Checking for Virtual Host (Win32_DiskDevice WMI)";
    flow:established,from_server;
    http.stat_code;
    content:"200";
    file.data;
    content:"Get-WmiObject -Query"; nocase;
    content:"Select|20|*|20|from|20|Win32_DiskDevice"; fast_pattern; nocase;
    content:"-contains|20|";
    pcre:"/^\x22(?:v(mware|irtual|irtualbox|m\x20ware|box))/Rsi";
    reference:url,researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/;
    classtype:bad-unknown;
    sid:2026077; rev:4;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2018_09_05, deployment Perimeter, deployment alert_only, performance_impact Low, confidence High, signature_severity Minor, tag PowerShell, tag Enumeration, tag Anti_VM, updated_at 2024_12_12;
)