Suspicious Start-Process PassThru

 1title: Suspicious Start-Process PassThru
 2id: 0718cd72-f316-4aa2-988f-838ea8533277
 3status: test
 4description: Powershell use PassThru option to start in background
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md
 7    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7
 8author: frack113
 9date: 2022-01-15
10tags:
11    - attack.defense-evasion
12    - attack.t1036.003
13logsource:
14    product: windows
15    category: ps_script
16    definition: 'Requirements: Script Block Logging must be enabled'
17detection:
18    selection:
19        ScriptBlockText|contains|all:
20            - Start-Process
21            - '-PassThru '
22            - '-FilePath '
23    condition: selection
24falsepositives:
25    - Legitimate PowerShell scripts
26level: medium

References

• atomic-red-team/atomics/T1036.003/T1036.003.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

• Start-Process (Microsoft.PowerShell.Management) - PowerShell

  

  The Start-Process cmdlet starts one or more processes on the local computer. By default, Start-Process creates a new process that inherits all the environment variables that are defined in the current process. To specify the program that runs in the process, enter an executable file or script file, or a file that can be opened using a program on the computer. If you specify a non-executable file, Start-Process starts the program that's associated with the file, similar to the Invoke-Item cmdlet. You can use the parameters of Start-Process to specify options, such as loading a user profile, starting the process in a new window, or using alternate credentials.

  
  Read More

Related rules

• File Download Via Bitsadmin
• File Download Via Bitsadmin To A Suspicious Target Folder
• File Download Via Bitsadmin To An Uncommon Target Folder
• File With Suspicious Extension Downloaded Via Bitsadmin
• LOL-Binary Copied From System Directory