Execution via Obfuscated PowerShell Script

[rule]
description = """
Identifies the execution of PowerShell with potentially obfuscated content. This behavior is often observed during
malware installation leveraging PowerShell.
"""
id = "ce95fc52-051e-4409-9c99-f2daf3e6e609"
license = "Elastic License v2"
name = "Execution via Obfuscated PowerShell Script"
os_list = ["windows"]
version = "1.0.11"

query = '''
api where process.Ext.api.name == "AmsiScanBuffer" and
 process.name : "powershell.exe" and user.id != "S-1-5-18" and

  /* obfuscated content */
  process.Ext.api.parameters.buffer : ("*-bxor*", "*:sptth*", "*//:p##h*", "*.rEplAcE(([chAr]*", "*$pShOMe[*", "*$ShellId[*", "*$env:Public[*",
  "*$env:ComSpec[*", "*ecalper-*", "*]rahc[*", "*NoiSsErpXe-eKoVNi*", "*elbairav-*", "*ECNErEFERpESObREv$*", "*.Name[3,11,2]*",
  "*sailA-teS*", "*]rtPtnI[*", "*-ekovnI*", "*TVqQAAMAAAAEAAAA*", "*System.Management.Automation.$([cHAr]*") and

  not (process.Ext.api.parameters.buffer : "*-bxor*" and process.Ext.api.parameters.buffer : "#powershellskript *") and
  not (process.Ext.api.parameters.buffer : "*-bxor*" and process.Ext.api.parameters.buffer : ("*-bxor 0xFFFF0000*", "*Ansible.Basic.AnsibleModule*")) and
  not (process.Ext.api.parameters.buffer : ("function Get-DbaProductKey*", "function Invoke-DbaDbDecryptObjec*") and process.Ext.api.parameters.buffer : "* -bxor *") and
  not (process.Ext.api.parameters.size >= 155000 and process.Ext.api.parameters.buffer : "*HSTITest_Encoded*TVqQAAMAAAAEAAAA*") and
  not (process.Ext.api.parameters.size == 38324 and
       process.command_line : "*AkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApAC*") and
  not process.Ext.api.parameters.content_name :
                    ("?:\\Program Files\\*.ps1",
                     "?:\\Program Files (x86)\\*.ps1",
                     "D:\\*", "E:\\*", "F:\\*", "I:\\*", "X:\\*",
                     "C:\\ProgramData\\NinjaRMMAgent\\scripting\\*.ps1",
                     "C:\\ProgramData\\chocolatey\\*.ps1",
                     "C:\\WINDOWS\\IMECache\\*",
                     "C:\\ProgramData\\CentraStage\\Packages\\*\\command.ps1") and
  not process.command_line : "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -windowstyle hidden -nologo Invoke-Expression $env:Include" and
  not process.parent.executable : ("C:\\Program Files (x86)\\ManageSoft\\Tracker\\ndtrack.exe",
                                   "C:\\Program Files (x86)\\CentraStage\\Gui.exe",
                                   "C:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShell.exe",
                                   "C:\\Program Files\\SentinelOne\\Sentinel Agent *\\Addons\\SentinelAddonHost.exe",
                                   "C:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShellService.exe",
                                   "C:\\Program Files\\Microsoft VS Code\\Code.exe",
                                   "C:\\Windows\\System32\\gpscript.exe",
                                   "C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                                   "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                                   "C:\\Windows\\System32\\drivers\\Intel\\ICPS\\IntelConnectivityNetworkService.exe",
                                   "C:\\Program Files\\Axis Communications\\AXIS Camera Station\\Components\\AXIS System Health Monitoring\\AXISSystemHealthMonitoring.exe")
'''

min_endpoint_version = "8.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"