detection.wiki

Detection rules › Sigma

PowerShell Execution With Potential Decryption Capabilities

Status
test
Severity
high
Log source
product windows, category process_creation
Author
X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

MITRE ATT&CK coverage

TacticTechniques
ExecutionNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: PowerShell Execution With Potential Decryption Capabilities
id: 434c08ba-8406-4d15-8b24-782cb071a691
status: test
description: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.
references:
    - https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-30
modified: 2023-12-05
tags:
    - attack.execution
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        OriginalFileName:
            - 'PowerShell.EXE'
            - 'pwsh.dll'
    selection_cli_dir:
        CommandLine|contains:
            - "Get-ChildItem "
            - "dir "
            - "gci "
            - "ls "
    selection_cli_gc:
        CommandLine|contains:
            - "Get-Content "
            - "gc "
            - 'cat '
            - 'type '
            - 'ReadAllBytes'
    selection_cli_specific:
        - CommandLine|contains|all:
              - ' ^| '
              - '\*.lnk'
              - '-Recurse'
              - '-Skip '
        - CommandLine|contains|all:
              - ' -ExpandProperty '
              - '\*.lnk'
              - 'WriteAllBytes'
              - ' .length '
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    OriginalFileName:
        - 'PowerShell.EXE'
        - 'pwsh.dll'

Stage 2: selection_cli_dir

selection_cli_dir:
    CommandLine|contains:
        - "Get-ChildItem "
        - "dir "
        - "gci "
        - "ls "

Stage 3: selection_cli_gc

selection_cli_gc:
    CommandLine|contains:
        - "Get-Content "
        - "gc "
        - 'cat '
        - 'type '
        - 'ReadAllBytes'

Stage 4: selection_cli_specific

selection_cli_specific:
    - CommandLine|contains|all:
          - ' ^| '
          - '\*.lnk'
          - '-Recurse'
          - '-Skip '
    - CommandLine|contains|all:
          - ' -ExpandProperty '
          - '\*.lnk'
          - 'WriteAllBytes'
          - ' .length '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -ExpandProperty
  • .length
  • ^|
  • -Recurse
  • -Skip
  • Get-ChildItem corpus 2 (sigma 2)
  • Get-Content corpus 2 (sigma 2)
  • ReadAllBytes
  • WriteAllBytes
  • \*.lnk
  • cat corpus 3 (sigma 3)
  • dir corpus 8 (sigma 5, splunk 2, chronicle 1)
  • gc
  • gci
  • ls
  • type corpus 6 (sigma 6)
Imageends_with
  • \powershell.exe corpus 182 (sigma 182)
  • \pwsh.exe corpus 168 (sigma 168)
OriginalFileNameeq
  • PowerShell.EXE corpus 120 (sigma 84, splunk 30, elastic 6)
  • pwsh.dll corpus 112 (sigma 79, splunk 30, elastic 3)