Detection rules › Sigma
HackTool - Evil-WinRm Execution - PowerShell Module
Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | No specific technique |
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
Rule body yaml
title: HackTool - Evil-WinRm Execution - PowerShell Module
id: 9fe55ea2-4cd6-4491-8a54-dd6871651b51
status: test
description: |
Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.
references:
- https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb
- https://github.com/search?q=repo%3AHackplayers%2Fevil-winrm++shell.run%28&type=code
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-02-25
tags:
- attack.lateral-movement
logsource:
product: windows
category: ps_module
detection:
selection_wsm:
ContextInfo|contains:
- ':\Windows\System32\wsmprovhost.exe'
- ':\Windows\SysWOW64\wsmprovhost.exe'
selection_payload_1:
Payload|contains:
- value="(get-location).path # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L592
- value="(get-item*).length # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L490
- 'Invoke-Binary ' # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L740
- Donut-Loader -process_id*-donutfile # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L761
- Bypass-4MSI
- IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','')
selection_payload_2:
Payload|contains|all:
- $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\"
- Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath
selection_payload_3:
Payload|contains|all:
- $a += \"$($_.FullName.Replace('\\','/'))/\"}else{ $a += \"$($_.FullName.Replace('\\', '/'))\" } # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L1001
- $a=@();$
condition: selection_wsm and 1 of selection_payload_*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selection_wsm and 1 of selection_payload_*Stage 1: selection_wsm
selection_wsm:
ContextInfo|contains:
- ':\Windows\System32\wsmprovhost.exe'
- ':\Windows\SysWOW64\wsmprovhost.exe'
Stage 2: selection_payload_1
selection_payload_1:
Payload|contains:
- value="(get-location).path
- value="(get-item*).length
- 'Invoke-Binary '
- Donut-Loader -process_id*-donutfile
- Bypass-4MSI
- IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','')
Stage 3: selection_payload_2
selection_payload_2:
Payload|contains|all:
- $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\"
- Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath
Stage 4: selection_payload_3
selection_payload_3:
Payload|contains|all:
- $a += \"$($_.FullName.Replace('\\','/'))/\"}else{ $a += \"$($_.FullName.Replace('\\', '/'))\" }
- $a=@();$
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ContextInfo | match |
|
Payload | match |
|