Ingress Tool Transfer via PowerShell

[rule]
description = """
Identifies the execution of files downloaded using Windows PowerShell. This tactic may be indicative of malicious
activity where malware is downloading second stage payloads using built-in Windows programs.
"""
id = "5abd98fb-ffbe-4cd6-9592-3cda7b155ff5"
license = "Elastic License v2"
name = "Ingress Tool Transfer via PowerShell"
os_list = ["windows"]
version = "1.0.26"

query = '''
process where event.action == "start" and not user.id : "S-1-5-18" and

 (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and

 (process.code_signature.trusted == false or 
  process.code_signature.exists == false or
  process.executable : ("?:\\Users\\Public\\*", "?:\\Windows\\Tasks\\*", "?:\\ProgramData\\*")) and

  (
    (process.parent.name : "powershell.exe" and process.parent.command_line : "*http*" and 
     not process.command_line : ("*bmx-panels-check.s3.us-east-1.amazonaws.com*", "*https://aka.ms/vscode-powershell*")) or

    descendant of [process where event.action == "start" and
                   process.name : "powershell.exe" and process.command_line : "*http*" and 
                   not process.command_line : ("*bmx-panels-check.s3.us-east-1.amazonaws.com*", "*https://aka.ms/vscode-powershell*")]
  )  and

  not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
  not (process.code_signature.subject_name : ("Chocolatey Software, Inc.", "Chocolatey Software, Inc", "Illumio, Inc.") and process.code_signature.trusted == true) and
  not process.executable : ("?:\\ProgramData\\Microsoft\\VisualStudio\\Packages\\*", 
                            "?:\\ProgramData\\chocolatey\\lib\\*", 
                            "?:\\Users\\*\\AppData\\Local\\Temp\\ns*.tmp\\*.exe",
                            "C:\\ProgramData\\chocolatey\\bin\\wacs.exe") and
  not process.parent.executable : "C:\\Program Files\\dotnet\\dotnet.exe" and
  not process.hash.sha256 : 
                 ("1aac95f980af717c580b1b32885f51e67f0c3631ca0e7cfb2908b75df9a3501c", 
                  "c73c4ac2a7cdc48829fe0f9d7ec91ca41c8b434490d4eb3205aad69c7aa3b921", 
                  "3655b300361f205778b3d998a158b7ffb962ede315d92c25c0735b7925b26d8e", 
                  "2aac5c0da14cce02f809e0619c17dcc42ed995898dfb43f8312a924dd6b62a8a",
                  "8426d62aebc7819badc0260eb7a9c83efb65d8c0534d83be691e215db53bf244",
                  "f9fabf2f1c975ae974ac88245b804b526f0e79a97ee7ccc814432784cffb02d4",
                  "d7c9b99aa403c0e629086e8e4acf6438a5489fe9070dc22d6b033d759414fb76",
                  "f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c97",
                  "d7c9b99aa403c0e629086e8e4acf6438a5489fe9070dc22d6b033d759414fb76",
                  "e815c36f5f62f2b5de4f2d273553424fc1bce6e735803633a5ca266b62c4efc5",
                  "8ed42db29649e7f20b2821ceef050ba6fa2260aca318b55ba56c3d2fdc292a89",
                  "95604b7ee58263efb39e260f6f94369d349b31c2bfc1fbf1a6598df126bd04d6",
                  "271dc2d7dd9fe171618cb4d1f8bd02a7b7cebb75288277f859e6b247b2d01e2d")
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.4.0"