Detection of Offensive PowerShell Script Execution via Module Logging

This brief catalogs common offensive PowerShell scripts utilized by various threat actors to facilitate post-exploitation activities. These scripts span a wide array of capabilities, including credential dumping (e.g., Mimikatz wrappers, Get-PassHashes), reconnaissance (e.g., PowerView, PowerUp), lateral movement (e.g., Invoke-PsExec), and persistence establishment. Because these tools are widely used across multiple campaigns, detection engineering teams should focus on PowerShell Module Logging (Event ID 4103/4104) to identify the invocation of these specific script names within the environment. Detecting these signatures provides visibility into active threat actor activity during the post-compromise phase, regardless of the initial entry vector. Defenders should prioritize identifying these scripts in non-administrative contexts or when executed by unexpected parent processes.

Impact

Successful execution of these scripts grants attackers significant visibility into internal networks, the ability to escalate privileges to domain administrator levels, and the capability to exfiltrate sensitive data or deploy ransomware. These scripts are frequently observed in the toolsets of groups such as Black Basta and actors utilizing frameworks like PowerSploit, Nishang, and WinPwn.

Recommendation

• Enable PowerShell Module Logging (Event ID 4103) and Script Block Logging (Event ID 4104) across all Windows endpoints to capture script execution context.
• Deploy the provided Sigma rule to monitor for the execution of these specific offensive script names.
• Establish alerting for these scripts when executed by non-IT or non-security service accounts.
• Integrate PowerShell logs with a SIEM and trigger high-priority alerts when these known offensive scripts are detected.