Suspicious PowerShell Keywords for Code Injection and Evasion
This rule detects the use of potentially suspicious keywords within PowerShell scripts that are often associated with exploitation frameworks or advanced attack techniques. Specifically, it looks for reflection-related keywords like 'System.Reflection.Assembly.Load', '[System.Reflection.Assembly]::Load', '[Reflection.Assembly]::Load', 'System.Reflection.AssemblyName', 'Reflection.Emit.AssemblyBuilderAccess', 'Reflection.Emit.CustomAttributeBuilder', and keywords related to interop services and process manipulation such as 'Runtime.InteropServices.UnmanagedType', 'Runtime.InteropServices.DllImportAttribute', 'SuspendThread', and 'rundll32'. These keywords can indicate attempts to load assemblies in-memory, interact with unmanaged code, or manipulate processes, which are common tactics used by malware and red teaming tools.
Sigma
