Malicious PowerShell Commandlets in Exploitation Frameworks
Detection of PowerShell commandlets commonly utilized within post-exploitation frameworks to perform credential dumping, lateral movement, and system reconnaissance.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 05:38 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
This brief highlights a collection of PowerShell commandlets associated with well-known offensive security and exploitation frameworks. These commandlets are frequently observed in post-exploitation scenarios, including credential harvesting (e.g., Mimikatz wrappers), privilege escalation, and domain reconnaissance. Defenders should monitor for the execution of these specific function names within PowerShell process command lines.
Recommendation
- Deploy the provided Sigma rule to detect the execution of known offensive PowerShell commandlets.
- Baseline PowerShell usage in your environment to identify legitimate administrative scripts that may utilize similarly named functions.
- Enable Script Block Logging (Event ID 4104) to capture the full execution context, as command line arguments can be obfuscated or truncated in standard process-creation logs.
Immediate actions
Deploy Sigma detection for commandlet names
Threat Hunt
Hunt for rare PowerShell commandlets in process execution logs
Data: Process command line arguments
Detection coverage 1
Detect Malicious PowerShell Commandlets
highDetects execution of PowerShell commandlets commonly used in offensive security and post-exploitation frameworks.
Detection queries are available on the platform. Get full rules →