HackTool - Evil-WinRm Execution - PowerShell Module
Description
Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.
Query · sigma
selection_wsm:
ContextInfo|contains:
- :\Windows\System32\wsmprovhost.exe
- :\Windows\SysWOW64\wsmprovhost.exe
selection_payload_1:
Payload|contains:
- value="(get-location).path
- value="(get-item*).length
- 'Invoke-Binary '
- Donut-Loader -process_id*-donutfile
- Bypass-4MSI
- IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','')
selection_payload_2:
Payload|contains|all:
- $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\"
- Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } |
Select-Object pschildname,imagepath
selection_payload_3:
Payload|contains|all:
- $a += \"$($_.FullName.Replace('\\','/'))/\"}else{ $a += \"$($_.FullName.Replace('\\',
'/'))\" }
- $a=@();$
condition: selection_wsm and 1 of selection_payload_*
Known false positives
- Unknown