Potential Process Execution Proxy Via CL_Invocation.ps1

calendar Oct 28, 2023 · attack.defense_evasion attack.t1216  ·
Share on: linkedin copy

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"

Sigma rule (View on GitHub)

 1title: Potential Process Execution Proxy Via CL_Invocation.ps1
 2id: a0459f02-ac51-4c09-b511-b8c9203fc429
 3status: test
 4description: Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"
 5references:
 6    - https://lolbas-project.github.io/lolbas/Scripts/Cl_invocation/
 7    - https://twitter.com/bohops/status/948061991012327424
 8author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova
 9date: 2020/10/14
10modified: 2023/08/17
11tags:
12    - attack.defense_evasion
13    - attack.t1216
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection:
19        # Note: As this function is usually called from within powershell, classical process creation even would not catch it. This will only catch inline calls via "-Command" or "-ScriptBlock" flags for example.
20        CommandLine|contains: 'SyncInvoke '
21    condition: selection
22falsepositives:
23    - Unknown
24level: medium

References

  • Cl_invocation | LOLBAS

    Import the PowerShell Diagnostic CL_Invocation script and call SyncInvoke to launch an executable. . C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1 \nSyncInvoke [args] Use caseProxy execution...


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

Related rules

to-top