CmdID

CmdID / Rules / Windows

Import New Module Via PowerShell CommandLine

A Sigma rule for process creation on Windows, from SigmaHQ’s threat hunting rules, by Nasreddine Bencherchali (Nextron Systems).

low 2 programs it names 12 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it
detection:
  filter_main_vsstudio:
    CommandLine|contains|all:
      - ':\Program Files\Microsoft Visual Studio\'
      - 'Tools\Microsoft.VisualStudio.DevShell.dll'
    ParentImage|contains:
      - ':\Program Files\WindowsApps\Microsoft.WindowsTerminal_'
      - ':\Windows\System32\cmd.exe'
  selection_cmdlet:
    CommandLine|contains:
      - 'Import-Module '
      - 'ipmo '
  selection_img:
    - Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    - OriginalFileName:
        - 'PowerShell.EXE'
        - 'pwsh.dll'
  condition: all of selection_* and not 1 of filter_main_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Nasreddine Bencherchali (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Export commands from a remote computer on the page for Export-PSSession

$credential = Get-Credential -UserName 'Server01\User01' -Message 'Enter credentials for Server01' $newSession = @{ ComputerName = 'Server01' Credential = $credential } $S = New-PSSession @newSession $exportSession = @{ Session = $S OutputModule = 'TestCmdlets' Type = 'Cmdlet' CommandName = 'test' FormatTypeName = '*' } Export-PSSession @exportSession Remove-PSSession $S Import-Module TestCmdlets Get-Help Test* Test-FilesIdentify

Export commands from a closed PSSession on the page for Export-PSSession

$Options = New-PSSessionOption -NoMachineProfile $S = New-PSSession -ComputerName Server01 -SessionOption $Options Export-PSSession -Session $S -OutputModule Server01 Remove-PSSession $S New-PSSession -ComputerName Server01 -SessionOption $Options Import-Module Server01Identify

Get formatting data and export it on the page for Get-FormatData

$A = Get-FormatData Import-Module BitsTransfer $B = Get-FormatData Compare-Object $A $BIdentify

Import the members of a module into the current session on the page for Import-Module

Import-Module -Name PSDiagnosticsIdentify

Import the members of several modules into the current session on the page for Import-Module

$m = Get-Module -ListAvailable PSDiagnostics, Dism Import-Module -ModuleInfo $mIdentify

Import all modules specified by a path on the page for Import-Module

Import-Module -Name C:\ps-test\modules\test -VerboseIdentify

Restrict module members imported into a session on the page for Import-Module

Import-Module PSDiagnostics -Function Disable-PSTrace, Enable-PSTrace (Get-Module PSDiagnostics).ExportedCommandsIdentify

Import the members of a module and add a prefix on the page for Import-Module

Import-Module PSDiagnostics -Prefix x -PassThruIdentify

Reimport a module into the same session on the page for Import-Module

Import-Module PSDiagnostics Import-Module PSDiagnostics -Force -Prefix PSIdentify

Import a minimum version of a module on the page for Import-Module

Import-Module -Name PowerShellGet -MinimumVersion 2.0.0Identify

Import cmdlets and functions from a Windows PowerShell module on the page for Import-PSSession

$S = New-PSSession -ComputerName Server01 Invoke-Command -Session $S {Import-Module TestManagement} Import-PSSession -Session $S -Module TestManagementIdentify

Collect and save data by using a background job on the page for Start-Job

Start-Job -Name GetMappingFiles -InitializationScript {Import-Module -Name MapFunctions} -ScriptBlock { Get-Map -Name * | Set-Content -Path D:\Maps.tif } -RunAs32Identify

The commands documented for cl_loadassembly.ps1, utilityfunctions.ps1 trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here
powershellpowershell.exe