Detection rules › Splunk
Encoded Powershell Command (Sysmon)
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Encoded commands could be a way for an attacker to obfuscate malicious scripts they are executing on the victim machine
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
| Stealth | T1027 Obfuscated Files or Information |
References
- https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '1001.1055'
title: Encoded Powershell Command
description: 'PowerShell is a powerful interactive command-line interface and scripting
environment included in the Windows operating system. Adversaries can use PowerShell
to perform a number of actions, including discovery of information and execution
of code. Encoded commands could be a way for an attacker to obfuscate malicious
scripts they are executing on the victim machine. -- Threat Actor Association: Actinium/Gamaredon/Primitive
Bear, APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422,
STRONTIUM), APT29/Nobelium, APT35/Phosphorus/Magic Hound, BlackByte, DarkSide, BlackMatter,
FIN7, Memento Team, MuddyWater, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003),
Vice Society, Volt Typhoon - Software Attribution: ALPHV/BlackCat, Bazarloader,
Black Basta, Conti, Emotet, LV, MirrorBlast, Prestige, PYSA/Mespinoza, Ransom Cartel,
TargetCompany, TrickBot, XingLocker, Yellow Cocaktoo/Jupiter Infostealer, WhisperGate
- #TrendingThreat #Russia #Ukraine - Atomics T1027 Test #2 Atomics T1027 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=1 OR "EventID>1<")
"powershell" ((TERM(-e) OR TERM(-ec) OR TERM(-en) OR TERM(-enc) OR TERM(-enco) OR
TERM(-encod) OR TERM(-encode) OR TERM(-encoded) OR TERM(-encodedc) OR TERM(-encodedco)
OR TERM(-encodedcommand) OR "-encodedcom*") OR "[System.Convert]::FromBase64String()")
| table _time, host, user event_id, process, process_id, process_name, process_path,
signature_id, src_user, tag, user, user_id | rex field=process "(?<base64_cmd>\w{20,1000}=?)"
| rex field=process "(?i)powershell.*\s+-(e|en|ec|enco|encod|encode|encoded|encodedc|encodedco|encodedcom\S+)\s+(?<base64_cmd>[a-z0-9+\/=]+)"
| avlbase64 type=decode field=base64_cmd | rename base64_base64_cmd as base64_decoded_cmd
| rex field=base64_decoded_cmd "(?i)powershell.*\s+-(e|en|ec|enco|encod|encode|encoded|encodedc|encodedco|encodedcom\S+)\s+(?<base64_cmd_2nd_level>[a-z0-9+\/=]+)"
| avlbase64 type=decode field=base64_cmd_2nd_level | rename base64_base64_cmd_2nd_level
as base64_decoded_cmd_2nd_level | eval base64_decoded_cmd=coalesce(base64_decoded_cmd_2nd_level,base64_decoded_cmd) '
techniques:
- defense-evasion:obfuscated files or information
- execution:command and scripting interpreter:powershell
technique_id:
- T1027
- T1059.001
data_category:
- Windows Sysmon
references:
- https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=1 OR "EventID>1<") "powershell" ((TERM(-e) OR TERM(-ec) OR TERM(-en) OR TERM(-enc) OR TERM(-enco) OR TERM(-encod) OR TERM(-encode) OR TERM(-encoded) OR TERM(-encodedc) OR TERM(-encodedco) OR TERM(-encodedcommand) OR "-encodedcom*") OR "[System.Convert]::FromBase64String()")
Stage 2: table
| table _time, host, user event_id, process, process_id, process_name, process_path, signature_id, src_user, tag, user, user_id
Stage 3: rex
| rex field=process "(?<base64_cmd>\w{20,1000}=?)"
Stage 4: rex
| rex field=process "(?i)powershell.*\s+-(e|en|ec|enco|encod|encode|encoded|encodedc|encodedco|encodedcom\S+)\s+(?<base64_cmd>[a-z0-9+\/=]+)"
Stage 5: search
| avlbase64 type=decode field=base64_cmd
Stage 6: rename
| rename base64_base64_cmd as base64_decoded_cmd
Stage 7: rex
| rex field=base64_decoded_cmd "(?i)powershell.*\s+-(e|en|ec|enco|encod|encode|encoded|encodedc|encodedco|encodedcom\S+)\s+(?<base64_cmd_2nd_level>[a-z0-9+\/=]+)"
Stage 8: search
| avlbase64 type=decode field=base64_cmd_2nd_level
Stage 9: rename
| rename base64_base64_cmd_2nd_level as base64_decoded_cmd_2nd_level
Stage 10: eval
| eval base64_decoded_cmd=coalesce(base64_decoded_cmd_2nd_level,base64_decoded_cmd)
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "EventID>1<" |
| 1 | "powershell" |
| 1 | "-e" |
| 1 | "-ec" |
| 1 | "-en" |
| 1 | "-enc" |
| 1 | "-enco" |
| 1 | "-encod" |
| 1 | "-encode" |
| 1 | "-encoded" |
| 1 | "-encodedc" |
| 1 | "-encodedco" |
| 1 | "-encodedcommand" |
| 1 | "-encodedcom*" |
| 1 | "[System.Convert]::FromBase64String()" |
| 5 | avlbase64 |
| 8 | avlbase64 |