detection.wiki

Detection rules › Sigma

Suspicious PowerShell Parent Process

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Teymur Kheirkhabarov, Harish Segar
Source
github.com/SigmaHQ/sigma

Detects a suspicious or uncommon parent processes of PowerShell

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Suspicious PowerShell Parent Process
id: 754ed792-634f-40ae-b3bc-e0448d33f695
related:
    - id: 692f0bec-83ba-4d04-af7e-e884a96059b6
      type: derived
status: test
description: Detects a suspicious or uncommon parent processes of PowerShell
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=26
author: Teymur Kheirkhabarov, Harish Segar
date: 2020-03-20
modified: 2023-02-04
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        - ParentImage|contains: 'tomcat'
        - ParentImage|endswith:
              - '\amigo.exe'
              - '\browser.exe'
              - '\chrome.exe'
              - '\firefox.exe'
              - '\httpd.exe'
              - '\iexplore.exe'
              - '\jbosssvc.exe'
              - '\microsoftedge.exe'
              - '\microsoftedgecp.exe'
              - '\MicrosoftEdgeSH.exe'
              - '\mshta.exe'
              - '\nginx.exe'
              - '\outlook.exe'
              - '\php-cgi.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\safari.exe'
              - '\services.exe'
              - '\sqlagent.exe'
              - '\sqlserver.exe'
              - '\sqlservr.exe'
              - '\vivaldi.exe'
              - '\w3wp.exe'
    selection_powershell:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - CommandLine|contains:
              - '/c powershell'  # FPs with sub processes that contained "powershell" somewhere in the command line
              - '/c pwsh'
        - Description: 'Windows PowerShell'
        - Product: 'PowerShell Core 6'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    condition: all of selection_*
falsepositives:
    - Other scripts
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_parent

selection_parent:
    - ParentImage|contains: 'tomcat'
    - ParentImage|endswith:
          - '\amigo.exe'
          - '\browser.exe'
          - '\chrome.exe'
          - '\firefox.exe'
          - '\httpd.exe'
          - '\iexplore.exe'
          - '\jbosssvc.exe'
          - '\microsoftedge.exe'
          - '\microsoftedgecp.exe'
          - '\MicrosoftEdgeSH.exe'
          - '\mshta.exe'
          - '\nginx.exe'
          - '\outlook.exe'
          - '\php-cgi.exe'
          - '\regsvr32.exe'
          - '\rundll32.exe'
          - '\safari.exe'
          - '\services.exe'
          - '\sqlagent.exe'
          - '\sqlserver.exe'
          - '\sqlservr.exe'
          - '\vivaldi.exe'
          - '\w3wp.exe'

Stage 2: selection_powershell

selection_powershell:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
    - CommandLine|contains:
          - '/c powershell'
          - '/c pwsh'
    - Description: 'Windows PowerShell'
    - Product: 'PowerShell Core 6'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /c powershell corpus 3 (sigma 3)
  • /c pwsh
Descriptioneq
  • Windows PowerShell corpus 2 (sigma 2)
Imageends_with
  • \powershell.exe corpus 182 (sigma 182)
  • \pwsh.exe corpus 168 (sigma 168)
OriginalFileNameeq
  • PowerShell.EXE corpus 120 (sigma 84, splunk 30, elastic 6)
  • pwsh.dll corpus 112 (sigma 79, splunk 30, elastic 3)
ParentImageends_with
  • \MicrosoftEdgeSH.exe
  • \amigo.exe
  • \browser.exe
  • \chrome.exe corpus 5 (sigma 5)
  • \firefox.exe corpus 4 (sigma 4)
  • \httpd.exe corpus 6 (sigma 6)
  • \iexplore.exe corpus 2 (sigma 2)
  • \jbosssvc.exe
  • \microsoftedge.exe corpus 2 (sigma 2)
  • \microsoftedgecp.exe
  • \mshta.exe corpus 13 (sigma 13)
  • \nginx.exe corpus 6 (sigma 6)
  • \outlook.exe corpus 5 (sigma 5)
  • \php-cgi.exe corpus 6 (sigma 6)
  • \regsvr32.exe corpus 11 (sigma 11)
  • \rundll32.exe corpus 15 (sigma 15)
  • \safari.exe
  • \services.exe corpus 8 (sigma 8)
  • \sqlagent.exe
  • \sqlserver.exe
  • \sqlservr.exe corpus 3 (sigma 3)
  • \vivaldi.exe corpus 2 (sigma 2)
  • \w3wp.exe corpus 12 (sigma 12)
ParentImagematch
  • tomcat
Producteq
  • PowerShell Core 6 corpus 3 (sigma 3)