Malicious ShellIntel PowerShell Commandlets Detected

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of specific PowerShell commandlets associated with the ShellIntel exploitation framework. These commandlets, such as 'Invoke-SMBAutoBrute', 'Invoke-GPOLinks', and 'Invoke-Potato', are commonly used for reconnaissance, privilege escalation, and lateral movement within a Windows environment. Detection relies on PowerShell Script Block Logging to capture the script text containing these commandlet names.