
title: Malicious ShellIntel PowerShell Commandlets
author: Max Altgelt, Tobias Michalski
date: 2021/08/09
description: Detects Commandlet names from ShellIntel exploitation scripts.
detection:
  SELECTION_1:
    ScriptBlockText:
    - '*Invoke-SMBAutoBrute*'
    - '*Invoke-GPOLinks*'
    - '*Out-Minidump*'
    - '*Invoke-Potato*'
  condition: SELECTION_1
falsepositives:
- Unknown
id: 402e1e1d-ad59-47b6-bf80-1ee44985b3a7
level: high
logsource:
  category: ps_script
  definition: Script Block Logging must be enable
  product: windows
modified: 2021/10/16
references:
- https://github.com/Shellntel/scripts/
status: experimental
tags:
- attack.execution
- attack.t1059.001
ruletype: SIGMA
