detection.wiki

Detection rules › Sigma

Encoded PowerShell payload deployed (PowerShell)

Status
experimental
Severity
high
Log source
product windows, category ['ps_module', 'ps_classic_script', 'ps_script']
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker deployed a service pointing to a hidden and encoded PowerShell payload.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell
StealthT1027 Obfuscated Files or Information

Event coverage

ProviderEventTitle
PowerShellEvent ID 4103Payload Context: ContextInfo User Data: UserData.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShellEvent ID 800Event ID 800

Rule body yaml

title: Encoded PowerShell payload deployed (PowerShell)
description: Detects scenarios where an attacker deployed a service pointing to a hidden and encoded PowerShell payload.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1059.001-PowerShell
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
- https://www.huntress.com/blog/from-powershell-to-payload-an-analysis-of-weaponized-malware
- https://www.huntress.com/blog/malware-deep-dive-examining-a-powershell-payload
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.md
- https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-in-october-2019
- https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
- https://unit42.paloaltonetworks.com/threat-brief-OWASSRF/
tags:
- attack.execution
- attack.t1059.001
- attack.defense_evasion
- attack.t1027
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - 'FromBase64String'
      - 'IO.StreamReader'
      - 'IO.Compression.'

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - 'FromBase64String'
      - 'IO.StreamReader'
      - 'IO.Compression.'

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - 'FromBase64String'
      - 'IO.StreamReader'
      - 'IO.Compression.'

  condition: 1 of selection*
falsepositives:
- Unknown
level: high

#- 'FromBase64String'
#- 'IO.StreamReader'
#- 'IO.Compression.'
#- '[System.Convert]::'
#- '[Convert]'
#- 'System.Diagnostics.Process'

Stages and Predicates

Stage 0: condition

1 of selection*

Stage 1: selection_powershell_native

selection_powershell_native:
  EventID: 800
  EventData|contains|all:
    - 'FromBase64String'
    - 'IO.StreamReader'
    - 'IO.Compression.'

Stage 2: selection_powershell_modern

selection_powershell_modern:
  EventID: 4103
  Payload|contains|all:
    - 'FromBase64String'
    - 'IO.StreamReader'
    - 'IO.Compression.'

Stage 3: selection_powershell_block

selection_powershell_block:
  EventID: 4104
  ScriptBlockText|contains|all:
    - 'FromBase64String'
    - 'IO.StreamReader'
    - 'IO.Compression.'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventDatamatch
  • FromBase64String
  • IO.Compression.
  • IO.StreamReader
Payloadmatch
  • FromBase64String
  • IO.Compression.
  • IO.StreamReader
ScriptBlockTextmatch
  • FromBase64String corpus 4 (sigma 2, splunk 2)
  • IO.Compression. corpus 2 (sigma 1, splunk 1)
  • IO.StreamReader corpus 2 (sigma 1, splunk 1)