ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound

SID: 2038605Rev: 20 viewsHistory

Sourceet/open

CreatedAugust 24, 2022

UpdatedDecember 12, 2024

Classificationbad-unknown

alert tcp-pkt $HOME_NET any -> any any (msg:"ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound"; flow:established,to_server; stream_size:server,<,5; content:"Windows PowerShell running as user"; startswith; fast_pattern; content:"|20|on|20|"; within:258; reference:url,github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1; classtype:bad-unknown; sid:2038605; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_08_24, deployment Perimeter, performance_impact Low, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_12_12;)

References

url	github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1

Metadata

attack targetClient_Endpoint

created at2022_08_24

deploymentPerimeter

performance impactLow

confidenceHigh

signature severityMinor

tagDescription_Generated_By_Proofpoint_Nexus

updated at2024_12_12

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!