Skip to content
Threat Feed

Product

PowerShell

10 briefs RSS
high advisory

PowerShell Kerberos Ticket Dumping via LSA Authentication Package Access

Detection of PowerShell scripts attempting to dump Kerberos tickets from memory by accessing LSA authentication packages, potentially leading to credential access and lateral movement.

PowerShell credential-access kerberos windows
2r 1t
high advisory

PowerShell Share Enumeration via ShareFinder or Native APIs

Detection of PowerShell scripts employing ShareFinder functions or Windows share enumeration APIs to discover accessible network shares for reconnaissance, lateral movement, or ransomware deployment.

PowerShell discovery share-enumeration lateral-movement ransomware
2r 1t
medium advisory

Incoming Execution via PowerShell Remoting

This rule identifies remote execution via Windows PowerShell remoting, which allows a user to run any Windows PowerShell command on one or more remote computers, potentially indicating lateral movement.

Elastic Defend +2 lateral-movement powershell remoting
2r 2t
high advisory

PowerShell P/Invoke Process Injection API Chain Detection

This analytic detects PowerShell code that uses P/Invoke to call Windows API functions associated with process injection, such as VirtualAlloc, WriteProcessMemory, and CreateRemoteThread, indicating potential malicious activity.

PowerShell +3 process-injection pinvoke defense-evasion
2r 8t
medium advisory

Remote File Download via PowerShell

Detects PowerShell being used to download executable files from untrusted remote destinations, a common technique for attackers to introduce tooling or malware into a compromised environment.

PowerShell command-and-control file-download windows
2r 2t
high advisory

PowerShell P/Invoke API Chain for Process Injection

This brief details detection of PowerShell scripts leveraging P/Invoke API calls to perform process injection, covering techniques like self-injection, remote thread injection, APC injection, thread-context hijacking, process hollowing, section-map injection, reflective DLL loading, and DLL injection.

PowerShell process-injection pinvoke
3r 7t
high advisory

PowerShell Obfuscation via String Concatenation

This rule detects PowerShell scripts employing string concatenation to evade static analysis and AMSI by fragmenting keywords or URLs at runtime.

PowerShell defense-evasion obfuscation windows
2r 1t
high advisory

PowerShell MiniDump Script Detection

This brief detects PowerShell scripts that reference MiniDumpWriteDump or full-memory minidump types, potentially used to capture process memory from credential-bearing processes like LSASS.

PowerShell credential-access minidump windows
2r 1t
high advisory

PowerShell Loading .NET Assemblies via Reflection

This analytic detects PowerShell scripts leveraging .NET reflection to load assemblies into memory, a technique commonly used by threat actors to bypass defenses and execute malicious code.

PowerShell reflection dotnet memory-injection attack.execution attack.t1059.001
2r 1t
high advisory

PowerShell Obfuscation via Backtick-Escaped Variable Expansion

PowerShell scripts use backtick-escaped characters inside `${}` variable expansion to reconstruct strings at runtime, enabling attackers to split keywords, hide commands, and evade static analysis and AMSI.

windows +1 powershell obfuscation defense-evasion variable-expansion
2r 1t