Powershell Injecting Into Anything (RedCanary Threat Detection Report)

 1title: Powershell Injecting Into Anything (RedCanary Threat Detection Report)
 2id: 3556964d-5ade-438c-bc68-58e0c64a70ec
 3status: experimental
 4description: Detects instances of PowerShell accessing any other processes. Part of the RedCanary 2023 Threat Detection Report.
 5references:
 6    - https://redcanary.com/threat-detection-report/techniques/process-injection/
 7author: RedCanary, Sigma formatting by Micah Babinski
 8date: 2023/05/10
 9tags:
10    - attack.privilege_escalation
11    - attack.t1055
12logsource:
13    category: process_access
14    product: windows
15detection:
16    selection:
17        SourceImage|endswith: '\powershell.exe'
18    condition: selection
19falsepositives:
20    - Unknown
21level: low```

References

• Process Injection - Red Canary Threat Detection Report

  

  Process Injection enables adversaries to execute potentially suspicious processes in the context of seemingly benign ones.

  
  Read More

Related rules

• Process Executing Sans Command Line (RedCanary Threat Detection Report)
• Suspicious Network Connections (RedCanary Threat Detection Report)
• PowerShell Injecting into Other Process
• Process Execution sans Command Lines
• Find Binary Searching for Executables with Setuid or Setguid Bit (RedCanary Threat Detection Report)