Detection rules › Elastic
Powershell Execution via Runscripthelper
Detects attempts to execute a powershell script bypassing constrained language mode using the RunScriptHelper utility.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
Rule body
[rule]
description = "Detects attempts to execute a powershell script bypassing constrained language mode using the RunScriptHelper utility."
id = "c199e7d9-0cbe-4190-a3c1-c552e64f1b6c"
license = "Elastic License v2"
name = "Powershell Execution via Runscripthelper"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/"]
version = "1.0.4"
query = '''
process where event.action == "start" and
(process.name : "runscripthelper.exe" or process.pe.original_file_name : "runscripthelper.exe") and
process.args : "surfacecheck" and process.args_count > 3
'''
min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.16.0"
Stages and Predicates
Stage 1: process
process where event.action == "start" and
(process.name : "runscripthelper.exe" or process.pe.original_file_name : "runscripthelper.exe") and
process.args : "surfacecheck" and process.args_count > 3
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
event.action | eq |
| field:"EventType" kind:eq value:"start" |
process.args | wildcard |
| field:"process.args" kind:wildcard value:"surfacecheck" |
process.args_count | gt |
| field:"process.args_count" kind:gt value:"3" |
process.name | wildcard |
| field:"process_name" kind:wildcard value:"runscripthelper.exe" |
process.pe.original_file_name | wildcard |
| field:"OriginalFileName" kind:wildcard value:"runscripthelper.exe" |