kqlElastic-2.0from elastic/detection-rules

PowerShell PSReflect Script

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1059 T1059.001 T1106

Rule sourcerules/windows/execution_posh_psreflect.toml

event.category:process and host.os.type:windows and
  powershell.file.script_block_text:(
    "New-InMemoryModule" or
    "Add-Win32Type" or
    psenum or
    DefineDynamicAssembly or
    DefineDynamicModule or
    "Reflection.TypeAttributes" or
    "Reflection.Emit.OpCodes" or
    "Reflection.Emit.CustomAttributeBuilder" or
    "Runtime.InteropServices.DllImportAttribute"
  ) and
  not user.id : "S-1-5-18"