detection.wiki

Detection rules › Kusto

CyberArkEPM - Possible execution of Powershell Empire

Severity
high
Time window
10m
Source
github.com/Azure/Azure-Sentinel

'Detects possible execution of Powershell Empire.'

MITRE ATT&CK coverage

TacticTechniques
Execution

Rule body

id: eddfd1fd-71df-4cc3-b050-287643bee398
name: CyberArkEPM - Possible execution of Powershell Empire
description: |
  'Detects possible execution of Powershell Empire.'
severity: High
requiredDataConnectors:
  - connectorId: CyberArkEPM
    dataTypes:
      - CyberArkEPM
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
relevantTechniques:
  - T1204
query: | 
  CyberArkEPM
  | where EventSubType != 'AttackAttempt'
  | where ActingProcessCommandLine has_any ('-NoP -sta -NonI -W Hidden -Enc', '-noP -sta -w 1 -enc', '-NoP -NonI -W Hidden -enc')
  | extend AccountCustomEntity = ActorUsername
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

CyberArkEPM

Stage 2: where

| where EventSubType != 'AttackAttempt'

Stage 3: where

| where ActingProcessCommandLine has_any ('-NoP -sta -NonI -W Hidden -Enc', '-noP -sta -w 1 -enc', '-NoP -NonI -W Hidden -enc')

Stage 4: extend

| extend AccountCustomEntity = ActorUsername

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ActingProcessCommandLinematch
  • -NoP -NonI -W Hidden -enc transforms: term
  • -NoP -sta -NonI -W Hidden -Enc transforms: term
  • -noP -sta -w 1 -enc transforms: term
field:"ParentCommandLine" kind:match
EventSubTypene
  • AttackAttempt
field:"EventSubType" kind:ne value:"AttackAttempt"

Output fields

These fields are emitted when the rule matches.

FieldSource
AccountCustomEntityextend