Detection rules › Sigma

Invoke-Obfuscation STDIN+ Launcher - System

Status
test
Severity
high
Log source
product windows, service system
Author
Jonathan Cheong, oscd.community
Source
github.com/SigmaHQ/sigma

Detects Obfuscated use of stdin to execute PowerShell

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: Invoke-Obfuscation STDIN+ Launcher - System
id: 72862bf2-0eb1-11eb-adc1-0242ac120002
status: test
description: Detects Obfuscated use of stdin to execute PowerShell
references:
    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 25)
author: Jonathan Cheong, oscd.community
date: 2020-10-15
modified: 2022-11-29
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: system
detection:
    selection_main:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        # ImagePath|re: 'cmd.{0,5}(?:\/c|\/r).+powershell.+(?:\$\{?input\}?|noexit).+\"'
        # Example 1: c:\windows\sYstEm32\CmD.eXE /C"echO\Invoke-Expression (New-Object Net.WebClient).DownloadString | POwersHELl -NoEXiT -"
        # Example 2: c:\WiNDOws\sysTEm32\cmd.EXe /C " ECHo Invoke-Expression (New-Object Net.WebClient).DownloadString | POwersHELl -nol ${EXEcUtIONCONTeXT}.INvOkEComMANd.InvOKEScRIPt( $InpUt )"
        ImagePath|contains|all:
            - 'cmd'
            - 'powershell'
        ImagePath|contains:
            - '/c'
            - '/r'
    selection_other:
        - ImagePath|contains: 'noexit'
        - ImagePath|contains|all:
              - 'input'
              - '$'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_main

selection_main:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
    ImagePath|contains|all:
        - 'cmd'
        - 'powershell'
    ImagePath|contains:
        - '/c'
        - '/r'

Stage 2: selection_other

selection_other:
    - ImagePath|contains: 'noexit'
    - ImagePath|contains|all:
          - 'input'
          - '$'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ImagePathmatch
  • $
  • /c corpus 4 (sigma 4)
  • /r corpus 2 (sigma 2)
  • cmd corpus 5 (sigma 5)
  • input corpus 2 (sigma 2)
  • noexit
  • powershell corpus 5 (sigma 5)
Provider_Nameeq
  • Service Control Manager corpus 50 (sigma 50)