Suspicious Powershell via Windows Power User Menu

[rule]
description = """
Identifies the execution of Windows Powershell via the Start Menu dialog box. Adversaries may use phishing to instruct
the victim to copy and paste malicious commands for execution via crafted phsihing web pages.
"""
id = "01bcebbb-6fce-4921-b932-e8f6da9e73fd"
license = "Elastic License v2"
name = "Suspicious Powershell via Windows Power User Menu"
os_list = ["windows"]
reference = ["https://x.com/g0njxa/status/1958506796798140569"]
version = "1.0.3"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and process.name == "powershell.exe" and process.args_count == 1 and
  process.parent.name == "explorer.exe" and
  process.parent.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|kernel32.dll|windows.storage.dll|shell32.dll|windows.storage.dll|shell32.dll|shcore.dll|kernel32.dll|ntdll.dll"]
 [api where process.name == "powershell.exe" and process.Ext.api.name == "AmsiScanBuffer" and process.Ext.api.parameters.buffer : ("* # *", "*iwr *", "*|iex*", "*invoke-web*", "*WebClient*", "*http*") and
  not process.Ext.api.parameters.buffer like ("*# https://go.microsoft.com/fwlink*",
                                              "#*", "$targetUser*", "wget https://*_windows_amd64.zip",
                                              "Get-LicCertificate*", "*go.microsoft.com/fwlink/*", "#---------*") and
  not process.Ext.api.parameters.content_name : "?*"]
 [any where event.category in ("network", "dns") and process.name == "powershell.exe" and dns.question.name != "go.microsoft.com"]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"