Suspicious PowerShell WindowStyle Option

Status: test
Severity: medium
Log source: category ps_script, product windows
Author: frack113, Tim Shelton (fp AWS)
Source: github.com/SigmaHQ/sigma

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564.003` Hide Artifacts: Hidden Window

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Suspicious PowerShell WindowStyle Option
id: 313fbb0a-a341-4682-848d-6d6f8c4fab7c
status: test
description: |
    Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
    In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md
author: frack113, Tim Shelton (fp AWS)
date: 2021-10-20
modified: 2023-01-03
tags:
    - attack.stealth
    - attack.t1564.003
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'powershell'
            - 'WindowStyle'
            - 'Hidden'
    filter:
        ScriptBlockText|contains|all:
            - ':\Program Files\Amazon\WorkSpacesConfig\Scripts\'
            - '$PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    ScriptBlockText|contains|all:
        - 'powershell'
        - 'WindowStyle'
        - 'Hidden'

Stage 2: `not filter`

filter:
    ScriptBlockText|contains|all:
        - ':\Program Files\Amazon\WorkSpacesConfig\Scripts\'
        - '$PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ScriptBlockText`	match	`$PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"$PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule"`
`ScriptBlockText`	match	`:\Program Files\Amazon\WorkSpacesConfig\Scripts\`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:":\Program Files\Amazon\WorkSpacesConfig\Scripts\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`Hidden` corpus 2 (sigma 2) `WindowStyle` `powershell` corpus 3 (sigma 3)	`field:"ScriptBlockText" kind:match`