Suspicious PowerShell Execution via Windows Scripts

[rule]
description = "Identifies suspicious PowerShell execution spawning from Windows Script Host processes (cscript or wscript.exe)."
id = "3899dd3b-f31a-4634-8467-55326cd87597"
license = "Elastic License v2"
name = "Suspicious PowerShell Execution via Windows Scripts"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper"]
version = "1.0.45"

query = '''
process where event.action == "start" and
  (process.name : ("powershell.exe", "pwsh.exe") or process.pe.original_file_name : ("powershell.exe", "pwsh.exe")) and
  (
   process.parent.name : ("wscript.exe", "mshta.exe") or
   (process.parent.name : "node.exe" and process.working_directory : ("?:\\Users\\*\\Downloads\\*", "?:\\Users\\*\\Desktop\\*", "?:\\Users\\*\\appdata\\*")) or
   (descendant of [process where event.action == "start" and process.name : ("wscript.exe", "mshta.exe")] and
    not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe"))
   ) and
   (
   process.args_count == 1 or
   process.command_line :
             ("*^*^*^*^*^*^*^*^*^*",
              "*''*''*''*",
              "*`*`*`*`*",
              "*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*",
              "*+*+*+*+*+*",
              "*$*$*$*$*",
              "*[char[]](*)*-join",
              "*Base64String*",
              "*[*Convert]*",
              "*.Text.Encoding*",
              "*.Compression.*",
              "*.replace(*",
              "*MemoryStream*",
              "*WriteAllBytes*",
              "* -en* *",
              "* -ec *",
              "* -e *",
              "* -ep *",
              "* /e *",
              "* /en* *",
              "* /ec *",
              "* /ep *",
              "*WebClient*",
              "*DownloadFile*",
              "*DownloadString*",
              "*BitsTransfer*",
              "*Invoke-Exp*",
              "*invoke-web*",
              "*Invoke-RestMethod*",
              "*iex*",
              "*iwr*",
              "*Reflection.Assembly*",
              "*Assembly.GetType*",
              "*.Sockets.*",
              "*Add-MpPreference*ExclusionPath*",
              "*raw.githubusercontent*")
   ) and
    /* false positives */
   not process.parent.name: ("gc_worker.exe", "gc_service.exe") and
   not process.parent.command_line : "*Windows\\TEMP\\nessus_*" and
   /* Issue #247 */
   not process.parent.executable :
                 ("?:\\Windows\\System32\\svchost.exe",
                  "?:\\Windows\\System32\\CompatTelRunner.exe",
                  "?:\\Windows\\System32\\taskeng.exe") and
   not process.parent.executable : "C:\\FVS\\FVSSoftware\\*\\bin\\x64\\Rscript.exe" and
   not process.Ext.token.integrity_level_name == "system" and

   /* many legit powershell commands uses those non shortened execution flags excluding Sync-AppvPublishingServer lolbas */
   not (process.args : ("-EncodedCommand", "Import-Module*", "-NonInteractive") and
        process.args : "-ExecutionPolicy" and not process.args : "Sync-AppvPublishingServer") and

   /* third party installation related FPs */
   not process.parent.args : "?:\\Windows\\system32\\gatherNetworkInfo.vbs" and
   not (process.parent.args : "Microsoft.SystemCenter.ICMPProbe.WithConsecutiveSamples.vbs" and process.args : "Get-SCOMAgent") and
   not (process.command_line : "*WEBLOGIC_ARGS_CURRENT_1.DATA*" and process.parent.command_line : "*Impact360*") and
   not process.args :  "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers;*" and
   not process.command_line : ("*.Access.IdentityReference*win32_SID.SID*", "*AGIAbQB4AC0AYQBwAC4AcwAzAC4AdQBzAC0AZQBhAHMAd*") and
   not (process.parent.args : "?:\\Users\\Prestige\\AppData\\Local\\Temp\\Rar$*\\KMS_VL_ALL_AIO.cmd  -elevated" and process.command_line : "*KMS_VL_ALL_AIO.cmd*") and
   not (process.parent.name : "cmd.exe" and
        process.parent.command_line : "*C:\\Program Files\\CheckPoint\\Harmony Connect\\resources\\build\\installation_scripts\\on_install\\on_install.bat*") and
   not process.args : "iwr https://*.s3.us-east-1.amazonaws.com/scripts/Start-SpeedTest.ps1 -UserAgent * -UseBasicParsing | invoke-expression" and
   not (process.parent.name : "wscript.exe" and
        process.parent.args : "C:\\Program Files (x86)\\Telivy\\Telivy Agent\\telivy.js") and
   not process.command_line : "c:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -executionpolicy bypass -WindowStyle Hidden -Command \"powershell.exe -executionpolicy bypass -WindowStyle Hidden -Command \\\"iwr bmx-panels-check.s3.us-east-1.amazonaws.com/scripts/Set-BMXFirewallPolicy.ps1 -UserAgent MzEyYTdjNzg1ZWI3 -UseBasicParsing | invoke-expression\\\"\"" and
   not (process.parent.name : "cmd.exe" and process.parent.args : "\\\\*\\netlogon\\*" and process.args : "\\\\*\\netlogon\\*.ps1") and
   not process.args : "C:\\Program Files\\Common Files\\EETI\\TouchModeXML\\RunRegisterAllUserTask.ps1" and
   not (process.parent.name: "cmd.exe" and process.args : ("C:\\PreVeil\\filesync\\PreVeil_Client", "C:\\ProgramData\\recycle\\ISO\\recycle.ps1")) and
   not (process.parent.command_line : "wscript //B checkschedule.wsf /baseUrl:https://utilities.pcpitstop.com") and
   not (process.parent.name : "cmd.exe" and
        process.parent.args : ("C:\\Users\\*\\AppData\\Local\\Temp\\DONDA-NetworkInfo-*.bat ",
                               "C:\\ProgramData\\Hays\\WallpaperRefresh\\SilentExecute.bat ",
                               "Files\\Tyco\\SiteServer\\TSP.ISS.WindowsServices.Host\\Command\\ComputerNameScripts\\toolbar.cmd ",
                               "Files\\Tyco\\SiteServer\\TSP.ISS.WindowsServices.Host\\Command\\ComputerNameScripts\\start.cmd ")) and

   /* developer and AI coding tools spawning PowerShell for system queries */
   not (
      (
        (process.parent.name : "node.exe" and
         process.parent.code_signature.subject_name : "OpenJS Foundation") or
         (process.parent.name : "claude.exe" and
          process.parent.code_signature.subject_name : "Anthropic, PBC") or
         (process.parent.name : "codex.exe" and
          process.parent.code_signature.subject_name : "OpenAI OpCo, LLC")
       ) and
        process.parent.code_signature.trusted == true)
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.8.0"