pentest-detection

pentest-detection

Defensive detection-rule writing. Converts pentest findings into detection rules — to catch future attacks.

Triggers

• "write a Sigma rule"
• "Splunk SPL query"
• "KQL hunting query"
• "Sentinel rule"
• "YARA signature"
• "Suricata rule"
• "detection coverage analysis"

Sigma (Vendor-Agnostic)

title: Suspicious PowerShell Encoded Command Execution
id: 12345678-1234-1234-1234-1234567890ab
status: experimental
description: Detects PowerShell with -EncodedCommand flag, common in payloads
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Team
date: 2026/05/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: powershell
  category: process_creation
detection:
  selection:
    EventID: 4104
    ScriptBlockText|contains:
      - '-EncodedCommand'
      - '-enc '
      - '-e '
  filter:
    User|startswith: 'NT AUTHORITY\SYSTEM'
  condition: selection and not filter
falsepositives:
  - Legitimate admin scripts
level: high

Splunk SPL

index=windows EventCode=4104
| where match(ScriptBlockText, "-EncodedCommand|-enc\s|-e\s")
| stats count by Computer, User, ScriptBlockText
| where count > 1
| sort -count

Elastic KQL

event.code:"4104"
AND powershell.file.script_block_text:(*-EncodedCommand* OR *-enc * OR *-e *)
AND NOT user.name:"SYSTEM"

Microsoft Sentinel KQL

SecurityEvent
| where EventID == 4104
| where EventData has_any ("-EncodedCommand", "-enc ", "-e ")
| where Account != "NT AUTHORITY\\SYSTEM"
| summarize count() by Computer, Account, EventData
| where count_ > 0

YARA (Malware/File Signature)

rule SuspiciousPowerShellLoader {
    meta:
        author = "Security Team"
        date = "2026-05-15"
        description = "Detects PowerShell with base64 + IEX pattern"
        tags = "attack.t1059.001"

    strings:
        $iex = "IEX" nocase
        $invoke = "Invoke-Expression" nocase
        $b64 = /[A-Za-z0-9+\/]{50,}={0,2}/   // base64 blob >= 50 char
        $download = "DownloadString" nocase
        $bypass = "ExecutionPolicy Bypass" nocase

    condition:
        ($iex or $invoke) and $b64 and ($download or $bypass)
}