HackTool - CrackMapExec PowerShell Obfuscation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

This rule detects the execution of PowerShell with specific command-line obfuscation patterns known to be used by the CrackMapExec (CME) penetration testing framework. The rule looks for PowerShell executable names and specific string patterns within the command line that CME uses for obfuscation, such as 'join*split', '( $ShellId[1]+$ShellId[13]+''x'')', '( $PSHome[*]+$PSHOME[*]+', '( $env:Public[13]+$env:Public[5]+''x'')', and '( $env:ComSpec[4,*,25]-Join'''')'. These patterns are designed to evade simple string-based detections.