FIN7 Reconnaissance and POWERTRASH PowerShell Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

This rule detects specific command-line patterns associated with FIN7's reconnaissance and POWERTRASH execution, as reported by WithSecureLabs. It looks for PowerShell commands that include '-noni -nop -exe bypass -f \\' and 'ADMIN$' or '-ex bypass -noprof -nolog -nonint -f' and 'C:\Windows\Temp\'. These patterns indicate attempts to execute PowerShell scripts, potentially for remote access or privilege escalation, often targeting administrative shares or temporary directories.