Powershell Inline Execution From A File

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects inline execution of PowerShell code from a file

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Powershell Inline Execution From A File
id: ee218c12-627a-4d27-9e30-d6fb2fe22ed2
status: test
description: Detects inline execution of PowerShell code from a file
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50
author: frack113
date: 2022-12-25
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_exec:
        CommandLine|contains:
            - 'iex '
            - 'Invoke-Expression '
            - 'Invoke-Command '
            - 'icm '
    selection_read:
        CommandLine|contains:
            - 'cat '
            - 'get-content '
            - 'type '
    selection_raw:
        CommandLine|contains: ' -raw'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_exec`

selection_exec:
    CommandLine|contains:
        - 'iex '
        - 'Invoke-Expression '
        - 'Invoke-Command '
        - 'icm '

Stage 2: `selection_read`

selection_read:
    CommandLine|contains:
        - 'cat '
        - 'get-content '
        - 'type '

Stage 3: `selection_raw`

selection_raw:
    CommandLine|contains: ' -raw'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-raw` `Invoke-Command` `Invoke-Expression` `cat` corpus 3 (sigma 3) `get-content` corpus 2 (sigma 2) `icm` corpus 2 (sigma 2) `iex` corpus 7 (sigma 6, elastic 1) `type` corpus 6 (sigma 6)	`field:"CommandLine" kind:match`

Powershell Inline Execution From A File

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_exec

Stage 2: selection_read

Stage 3: selection_raw

Indicators

Stage 0: `condition`

Stage 1: `selection_exec`

Stage 2: `selection_read`

Stage 3: `selection_raw`