SigmaHQ/rules/windows/powershell/powershell_cl_mutexverifiers_lolscript.yml

title: Execution via CL_Mutexverifiers.ps1
id: 39776c99-1c7b-4ba0-b5aa-641525eee1a4
description: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module
status: experimental
author: oscd.community, Natalia Shornikova
date: 2020/10/14
modified: 2021/05/21
references:
    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/CL_mutexverifiers.yml
    - https://twitter.com/pabraeken/status/995111125447577600
tags:
    - attack.defense_evasion
    - attack.t1216
logsource:
    product: windows
    service: powershell
    definition: Script block logging must be enabled
detection:
    selection:
        EventID: 4104
        ScriptBlockText|contains|all:
          - 'CL_Mutexverifiers.ps1'
          - 'runAfterCancelProcess'
    condition: selection
falsepositives:
    - Unknown
level: high