Renamed Powershell Under Powershell Channel

calendar Oct 28, 2023 · attack.execution attack.t1059.001  ·
Share on: linkedin copy

Detects renamed powershell

Sigma rule (View on GitHub)

 1title: Renamed Powershell Under Powershell Channel
 2id: 30a8cb77-8eb3-4cfb-8e79-ad457c5a4592
 3status: test
 4description: Detects renamed powershell
 5references:
 6    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
 7author: Harish Segar, frack113
 8date: 2020/06/29
 9modified: 2023/10/27
10tags:
11    - attack.execution
12    - attack.t1059.001
13logsource:
14    product: windows
15    category: ps_classic_start
16detection:
17    selection:
18        Data|contains: 'HostName=ConsoleHost'
19    # Note: Powershell Logging Data is localized. Meaning that "HostApplication" field will be translated to a different field on a non english layout. This rule doesn't take this into account due to the sheer ammount of possibilities. It's up to the user to add these cases.
20    filter_main_ps:
21        Data|contains:
22            - 'HostApplication=powershell'
23            - 'HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell'
24            - 'HostApplication=C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
25            # In some cases powershell was invoked with inverted slashes
26            - 'HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
27            - 'HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
28    condition: selection and not 1 of filter_main_*
29falsepositives:
30    - Unknown
31level: low

References

  • Hunting for PowerShell Abuse

    PowerShell is the favorit tool of IT guys, who are responsible for administration of Windows infrastructures. It allows them to manage differen services of the operating system and automate almost anything. But along with administrators, PowerShell also is liked by attackers and malware authors. The reason PowerShell is so attractive for adversaries is quite obvious: it has been included in essentially every Windows operating system by default for a decade, provides access to Windows API, and is rarely constrained, thus allowing adversaries to perform different tasks without risking being blocked. ttackers can use PowerShell to direct the execution of a local script, retrieve and execute remote resources using various network protocols, encode payloads passed via the command line, or load PowerShell into other processes. Because of so prevalence of PowerShell among adversaries for Threat Hunters it is very important to be able to detect malicious uses of PowerShell and defend against it. In the presentation author is going to demostrate an approaches for detection of PowerShell abuses based on different event sources like native Windows logging capabilities as well as usage of additional tools, like Sysmon or EDR solutions. How to collect traces of using PowerShell, how to filter out false positives, and how to find evidence of malicious uses among the remaining after filtering volume of events — all these questions will be answered in the talk for present and future threat hunters.


    Read More

Related rules

to-top