LoFP / legitimate use of exported commands array indexing in powershell scripts (should be rare)

Techniques

• t1027
• t1059
• t1059.001

Sample rules

PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script

• source: sigma
• technicques:
  • t1027
  • t1059
  • t1059.001

Description

Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands and invoke cmdlets indirectly by array index. This can be used to evade detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.

Detection logic

condition: all of selection_*
selection_index_used:
  ScriptBlockText|contains: '[*]'
selection_module_export_enum:
  ScriptBlockText|contains:
  - 'Get-Module '
  - 'gmo '
  ScriptBlockText|contains|all:
  - ListAvailable
  - Microsoft.PowerShell.Utility
  - ExportedCommands
  - Values