Bad Opsec PowerShell Code Artifacts

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•28

This rule detects specific code artifacts commonly found in offensive PowerShell payloads such as Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, and PowerSploit. These artifacts often remain unchanged due to poor operational security practices by attackers. The rule looks for specific strings like '$DoIt', 'harmj0y', 'mattifestation', '_RastaMouse', 'tifkin_', and '0xdeadbeef' within PowerShell script payloads.