Skip to content
Threat Feed
Subscribe
high advisory

Detection of Malicious PowerShell Framework Commandlets

This brief documents a comprehensive list of commandlet patterns associated with common PowerShell-based exploitation frameworks, privilege escalation tools, and post-exploitation modules used by threat actors.

This intelligence provides a consolidated detection baseline for activity originating from well-known PowerShell exploitation frameworks. These frameworks, including PowerSploit, Nishang, BloodHound, and others, utilize specific function names that are often logged during PowerShell Script Block Logging (Event ID 4104). Attackers leverage these scripts to perform reconnaissance, credential dumping, persistence, and lateral movement. By monitoring for these specific commandlet patterns, defenders can identify the execution of offensive security tools within their environment. This list covers a broad spectrum of techniques, ranging from AD reconnaissance (Invoke-ADRecon) to credential access (Invoke-Mimikatz) and data exfiltration, providing high-signal coverage for unauthorized administrative activity.

Attack Chain

  1. Initial delivery or staging of the PowerShell script to the target endpoint.
  2. Execution of the script, triggering PowerShell Script Block logging (Event ID 4104).
  3. Reconnaissance phase utilizing modules like Invoke-UserHunter or Get-System to map the environment.
  4. Credential access phase via modules such as Get-PassHashes, Invoke-Mimikatz, or Get-VaultCredential.
  5. Persistence mechanism installation using functions like Add-Persistence or Add-RegBackdoor.
  6. Privilege escalation via modules like Invoke-BypassUAC or Invoke-BadPotato.
  7. Exfiltration of sensitive data or credentials using functions like Invoke-DNSExfiltrator or Do-Exfiltration.

Impact

Successful execution of these PowerShell commandlets grants attackers a foothold, allowing for the extraction of sensitive credentials, full domain environment mapping, elevation of privileges to system or domain admin, and stealthy persistence within the victim's infrastructure.

Recommendation

Prioritize the implementation of PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints. Deploy the provided Sigma rule to detect these specific malicious commandlet patterns. Ensure logs are forwarded to a SIEM for immediate alerting and historical hunting. Exclude known administrative or deployment scripts from the detection logic to reduce noise.

Immediate actions

Enable PowerShell Script Block Logging (Event ID 4104) across all endpoints.

IT Operations 48h

Deploy the provided Sigma rule to detect malicious commandlets.

Detection Engineering 24h

Threat Hunt

Search for historical Event ID 4104 logs containing the listed commandlets.

T1059.001 high high confidence hunt now

Data: Powershell Operational logs

Mitigations

Implement JEA (Just Enough Administration) to limit PowerShell execution privileges.

short_term IT Operations

PowerShell abuse

Detection coverage 1

Detect Malicious PowerShell Commandlets - ScriptBlock

high

Detects known commandlet names associated with PowerShell-based exploitation frameworks via Script Block Logging.

sigma tactics: discovery, execution techniques: T1059.001 sources: ps_script, windows

Detection queries are available on the platform. Get full rules →