Process Executing with Unusual Command Lines

 1title: Process Executing with Unusual Command Lines
 2id: 9c644369-a7c5-4166-a702-930efd9b5579
 3status: experimental
 4description: Looks for the execution of non-powershell process with command lines
 5    matching common powershell format. Inspired by the 2022 Red Canary Threat Detection
 6    report.
 7references:
 8    - https://redcanary.com/threat-detection-report/techniques/rename-system-utilities/
 9author: Micah Babinski
10date: 2022/11/04
11tags:
12    - attack.defense_evasion
13    - attack.t1036.003
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection:
19        CommandLine|contains:
20            - 'iex'
21            - 'invoke-expression'
22    filter:
23        Image|endswith: '\powershell.exe'
24    condition: selection and not filter
25falsepositives:
26    - Unknown
27level: high```

References

• Rename System Utilities - Red Canary Threat Detection Report

  

  Adversaries rename system utilities to circumvent security controls and bypass detection logic dependent on process names and process paths.

  
  Read More

Related rules

• Process Executing with Unusual Command Lines
• Unexpected Internal Process Name
• Abusing PowerShell to Disable Defender Components
• Abusing PowerShell to Modify Defender Components
• Application Bypass with RunDLL32 and DllRegisterServer Function