LoFP / legitimate use of exported commands array indexing during powershell command execution (should be rare)

Techniques

• t1027
• t1027.010
• t1059
• t1059.001

Sample rules

PowerShell Dynamic Module Invocation Via ExportedCommands Array Index

• source: sigma
• technicques:
  • t1027
  • t1027.010
  • t1059
  • t1059.001

Description

Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility exported commands and invoke cmdlets indirectly by array index. This technique is used to evade detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.

Detection logic

condition: all of selection_*
selection_img:
- Image|endswith:
  - \powershell.exe
  - \pwsh.exe
- OriginalFileName:
  - powershell.exe
  - pwsh.dll
selection_index_used:
  CommandLine|contains: '[*]'
selection_module_export_enum:
  CommandLine|contains:
  - 'Get-Module '
  - 'gmo '
  CommandLine|contains|all:
  - ListAvailable
  - Microsoft.PowerShell.Utility
  - ExportedCommands
  - Values