Suspicious Windows Powershell Arguments

  1[metadata]
  2creation_date = "2024/09/06"
  3integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the execution of PowerShell with suspicious argument values. This behavior is often observed during malware
 11installation leveraging PowerShell.
 12"""
 13from = "now-9m"
 14index = [
 15    "logs-endpoint.events.process-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-m365_defender.event-*",
 18    "logs-sentinel_one_cloud_funnel.*",
 19    "logs-system.security*",
 20    "logs-windows.forwarded*",
 21    "logs-windows.sysmon_operational-*",
 22    "winlogbeat-*",
 23    "endgame-*",
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27name = "Suspicious Windows Powershell Arguments"
 28note = """## Triage and analysis
 29
 30> **Disclaimer**:
 31> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 32
 33### Investigating Suspicious Windows Powershell Arguments
 34
 35PowerShell is a powerful scripting language and command-line shell used for task automation and configuration management in Windows environments. Adversaries exploit PowerShell's capabilities to execute malicious scripts, download payloads, and obfuscate commands. The detection rule identifies unusual PowerShell arguments indicative of such abuse, focusing on patterns like encoded commands, suspicious downloads, and obfuscation techniques, thereby flagging potential threats for further investigation.
 36
 37### Possible investigation steps
 38
 39- Review the process command line and arguments to identify any encoded or obfuscated content, such as Base64 strings or unusual character sequences, which may indicate malicious intent.
 40- Check the parent process of the PowerShell execution, especially if it is explorer.exe or cmd.exe, to determine if the PowerShell instance was launched from a suspicious or unexpected source.
 41- Investigate any network activity associated with the PowerShell process, particularly looking for connections to known malicious domains or IP addresses, or the use of suspicious commands like DownloadFile or DownloadString.
 42- Examine the user account associated with the PowerShell execution to determine if it aligns with expected behavior or if it might be compromised.
 43- Correlate the event with other security alerts or logs from the same host or user to identify patterns or additional indicators of compromise.
 44- Assess the risk and impact of the detected activity by considering the context of the environment, such as the presence of sensitive data or critical systems that might be affected.
 45
 46### False positive analysis
 47
 48- Legitimate administrative scripts may use encoded commands for obfuscation to protect sensitive data. Review the script's source and purpose to determine if it is authorized. If confirmed, add the script's hash or specific command pattern to an allowlist.
 49- Automated software deployment tools might use PowerShell to download and execute scripts from trusted internal sources. Verify the source and destination of the download. If legitimate, exclude the specific tool or process from the detection rule.
 50- System maintenance tasks often involve PowerShell scripts that manipulate files or system settings. Identify routine maintenance scripts and exclude their specific command patterns or file paths from triggering the rule.
 51- Security software may use PowerShell for scanning or remediation tasks, which can mimic suspicious behavior. Confirm the software's legitimacy and add its processes to an exception list to prevent false alerts.
 52- Developers might use PowerShell for testing or development purposes, which can include obfuscation techniques. Validate the developer's activities and exclude their specific development environments or scripts from the rule.
 53
 54### Response and remediation
 55
 56- Immediately isolate the affected system from the network to prevent further spread or communication with potential command and control servers.
 57- Terminate any suspicious PowerShell processes identified by the detection rule to halt ongoing malicious activities.
 58- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any malicious payloads or scripts.
 59- Review and clean up any unauthorized changes to system configurations or scheduled tasks that may have been altered by the malicious PowerShell activity.
 60- Restore any affected files or system components from known good backups to ensure system integrity and functionality.
 61- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are compromised.
 62- Implement additional monitoring and logging for PowerShell activities across the network to enhance detection of similar threats in the future."""
 63risk_score = 47
 64rule_id = "83bf249e-4348-47ba-9741-1202a09556ad"
 65severity = "medium"
 66tags = [
 67    "Domain: Endpoint",
 68    "OS: Windows",
 69    "Use Case: Threat Detection",
 70    "Tactic: Execution",
 71    "Data Source: Windows Security Event Logs",
 72    "Data Source: Elastic Defend",
 73    "Data Source: Sysmon",
 74    "Data Source: SentinelOne",
 75    "Data Source: Microsoft Defender XDR",
 76    "Data Source: Crowdstrike",
 77    "Data Source: Elastic Endgame",
 78    "Resources: Investigation Guide",
 79    "Noise: High",
 80    "Performance: Normal",
 81    "Profile: Aggressive",
 82    "Threat: Script-Based Execution",
 83    "Rule Type: Event Correlation (EQL)",
 84    "Platform: Windows",
 85]
 86timestamp_override = "event.ingested"
 87type = "eql"
 88
 89query = '''
 90process where host.os.type == "windows" and event.type == "start" and
 91 process.name : "powershell.exe" and
 92
 93  not (
 94    ?user.id == "S-1-5-18" and
 95    /* Don't apply the user.id exclusion to Sysmon for compatibility */
 96    not data_stream.dataset : ("windows.sysmon_operational", "windows.sysmon")
 97  ) and
 98
 99  not process.parent.executable : (
100        "?:\\Program Files\\*.exe",
101        "?:\\Program Files (x86)\\*.exe"
102  ) and
103
104  (
105    process.command_line : (
106          "*^*^*^*^*^*^*^*^*^*",
107          "*`*`*`*`*",
108          "*+*+*+*+*+*+*",
109          "*[char[]](*)*-join*",
110          "*Base64String*",
111          "*[*Convert]*",
112          "*.Compression.*",
113          "*-join($*",
114          "*MemoryStream*",
115          "*WriteAllBytes*",
116          "* -enc *",
117          "* -ec *",
118          "* /e *",
119          "* /enc *",
120          "* /ec *",
121          "*WebClient*",
122          "*DownloadFile*",
123          "*DownloadString*",
124          "* iex*",
125          "* iwr*",
126          "* aQB3AHIAIABpA*",
127          "*Reflection.Assembly*",
128          "*Assembly.GetType*",
129          "*$env:temp\\*start*",
130          "*powercat*",
131          "*nslookup -q=txt*",
132          "*$host.UI.PromptForCredential*",
133          "*Net.Sockets.TCPClient*",
134          "*curl *;Start*",
135          "powershell.exe \"<#*",
136          "*ssh -p *",
137          "*http*|iex*",
138          "*@SSL\\DavWWWRoot\\*.ps1*",
139          "*.lnk*.Seek(0x*",
140          "*[string]::join(*",
141          "*[Array]::Reverse($*",
142          "* hidden $(gc *",
143          "*=wscri& set*",
144          "*http'+'s://*",
145          "*.content|i''Ex*",
146          "*//:sptth*",
147          "*//:ptth*",
148          "*h''t''t''p*",
149          "*'tp'':''/'*",
150          "*$env:T\"E\"MP*",
151          "*;cmd /c $?",
152          "*s''t''a''r*",
153          "*$*=Get-Content*AppData*.SubString(*$*",
154          "*=cat *AppData*.substring(*);*$*",
155          "*-join'';*|powershell*",
156          "*.Content;sleep *|powershell*",
157          "*h\''t\''tp:\''*",
158          "*-e aQB3AHIAIABp*",
159          "*iwr *https*).Content*",
160          "*$env:computername*http*",
161          "*;InVoKe-ExpRESsIoN $COntent.CONTENt;*",
162          "*WebClient*example.com*",
163          "*=iwr $*;iex $*",
164          "*ServerXmlHttp*IEX*",
165          "*XmlDocument*IEX*"
166    ) or
167
168    (
169      process.command_line : "*.replace*" and
170      /* exclude known process and network inventory collection patterns */
171      not process.command_line : (
172        "*Get-CimInstance -Class Win32_Process*ConvertTo-Csv*Select-Object*$_.Replace*",
173        "*function replace_unallowed*$s.replace*Get-Counter*Network Adapter*"
174      )
175    ) or
176
177    (process.args : "-c" and process.args : "&{'*") or
178
179    (process.args : "-Outfile" and process.args : "Start*") or
180
181    (process.args : "-bxor" and process.args : "0x*") or
182
183    process.args : "$*$*;set-alias" or
184
185    process.args == "-e" or
186
187    // ATHPowerShellCommandLineParameter
188    process.args : ("-EncodedCommandParamVariation", "-UseEncodedArguments", "-CommandParamVariation") or
189
190    (
191      process.parent.name : ("explorer.exe", "cmd.exe") and
192      process.command_line : ("*-encodedCommand*", "*Invoke-webrequest*", "*WebClient*", "*Reflection.Assembly*"))
193    ) and
194    not process.command_line : (
195      "*Use-Icinga -Minimal*",
196      "*& {$j = sajb {Add-Type -AssemblyName*"
197    )
198'''
199
200setup = """## Setup
201
202This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
203
204Setup instructions: https://ela.st/install-elastic-defend
205
206### Additional data sources
207
208This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
209
210- [CrowdStrike](https://ela.st/crowdstrike-integration)
211- [Microsoft Defender XDR](https://ela.st/m365-defender)
212- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
213- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
214- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
215"""
216
217
218[[rule.threat]]
219framework = "MITRE ATT&CK"
220
221[[rule.threat.technique]]
222id = "T1059"
223name = "Command and Scripting Interpreter"
224reference = "https://attack.mitre.org/techniques/T1059/"
225
226[[rule.threat.technique.subtechnique]]
227id = "T1059.001"
228name = "PowerShell"
229reference = "https://attack.mitre.org/techniques/T1059/001/"
230
231[rule.threat.tactic]
232id = "TA0002"
233name = "Execution"
234reference = "https://attack.mitre.org/tactics/TA0002/"
235
236[[rule.threat]]
237framework = "MITRE ATT&CK"
238
239[[rule.threat.technique]]
240id = "T1105"
241name = "Ingress Tool Transfer"
242reference = "https://attack.mitre.org/techniques/T1105/"
243
244[rule.threat.tactic]
245id = "TA0011"
246name = "Command and Control"
247reference = "https://attack.mitre.org/tactics/TA0011/"
248
249[[rule.threat]]
250framework = "MITRE ATT&CK"
251
252[[rule.threat.technique]]
253id = "T1027"
254name = "Obfuscated Files or Information"
255reference = "https://attack.mitre.org/techniques/T1027/"
256
257[[rule.threat.technique.subtechnique]]
258id = "T1027.010"
259name = "Command Obfuscation"
260reference = "https://attack.mitre.org/techniques/T1027/010/"
261
262[[rule.threat.technique]]
263id = "T1140"
264name = "Deobfuscate/Decode Files or Information"
265reference = "https://attack.mitre.org/techniques/T1140/"
266
267[rule.threat.tactic]
268id = "TA0005"
269name = "Defense Evasion"
270reference = "https://attack.mitre.org/tactics/TA0005/"