Potential POWERTRASH PowerShell Script Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•30

This rule detects the potential execution of the POWERTRASH PowerShell script by looking for a specific combination of strings within the PowerShell script block text. These strings include .NET framework components related to compression (IO.Compression.DeflateStream), memory manipulation (IO.MemoryStream), base64 decoding (::FromBase64String), and reflection/code execution (GetDelegateForFunctionPointer, .Invoke(), GlobalAssemblyCache). The presence of these indicators together suggests a highly obfuscated or advanced PowerShell script, often used for malicious purposes like in-memory execution or bypassing detection.