Detection of Malicious PowerShell Framework Commandlets

This intelligence provides a consolidated detection set for identifying the usage of common PowerShell-based exploitation and post-exploitation frameworks. The detection logic focuses on the execution of specific commandlets associated with tools such as PowerSploit, Nishang, ADRecon, and various credential dumping or lateral movement modules. These commandlets are frequently observed in unauthorized administrative activities and exploitation of Windows environments.

Recommendation

• Enable PowerShell Module Logging (Event ID 4103) across all Windows endpoints to capture commandlet execution metadata.
• Deploy the provided Sigma rule to your SIEM to monitor for the listed malicious commandlet strings within the "Payload" field.
• Establish a baseline for legitimate administrative scripts in your environment to distinguish them from the identified offensive toolkit commandlets.
• Investigate any alert generated by this rule immediately, as it often indicates active post-exploitation activity or credential harvesting.