vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

*: add APIs used by .NET samples for basic interactions

Browse source
This commit is contained in:
William Ballenthin 2022-06-08 11:18:23 -06:00
parent b96b279d81
commit 2d66aace99
4 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
load-code/powershell/run-powershell-expression.yml Normal file
View file

@ -0,0 +1,22 @@
rule:
meta:
name: run PowerShell expression
namespace: load-code/powershell/
authors:
- anamaria.martinezgom@mandiant.com
scope: function
att&ck:
- Execution::Command and Scripting Interpreter::PowerShell [T1059.001]
examples:
- 692f7fd6d198e804d6af98eb9e390d61:0x6000004
features:
- and:
- or:
- string: / iex\(/i
- string: / iex /i
- string: /Invoke-Expression/i
- api: System.Management.Automation.PowerShell::Create
- api: System.Management.Automation.PowerShell::AddScript
- api: System.Management.Automation.PowerShell::Invoke
- optional:
- substring: "powershell.exe "