Detection rules › Splunk
Encoded Powershell Command (Windows Event Log)
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Encoded commands could be a way for an attacker to obfuscate malicious scripts they are executing on the victim machine
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
| Stealth | T1027 Obfuscated Files or Information |
References
- https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '1001.1056'
title: Encoded Powershell Command
description: 'PowerShell is a powerful interactive command-line interface and scripting
environment included in the Windows operating system. Adversaries can use PowerShell
to perform a number of actions, including discovery of information and execution
of code. Encoded commands could be a way for an attacker to obfuscate malicious
scripts they are executing on the victim machine. -- Threat Actor Association: Actinium/Gamaredon/Primitive
Bear, APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422,
STRONTIUM), APT29/Nobelium, APT35/Phosphorus/Magic Hound, BlackByte, DarkSide, BlackMatter,
FIN7, Memento Team, MuddyWater, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003),
Vice Society, Volt Typhoon - Software Attribution: ALPHV/BlackCat, Bazarloader,
Black Basta, Conti, Emotet, LV, MirrorBlast, Prestige, PYSA/Mespinoza, Ransom Cartel,
TargetCompany, TrickBot, XingLocker, Yellow Cocaktoo/Jupiter Infostealer, WhisperGate
- #TrendingThreat #Russia #Ukraine - Atomics T1027 Test #2 Atomics T1027 Test #3'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` ("EventCode=4688" OR "EventID>4688<")
(TERM(-e) OR TERM(-ec) OR TERM(-en) OR TERM(-enc) OR TERM(-enco) OR TERM(-encod)
OR TERM(-encode) OR TERM(-encoded) OR TERM(-encodedc) OR TERM(-encodedco) OR TERM(-encodedcommand)
OR "-encodedcom*") | regex process="(?i)powershell.*\s+-(e|en|ec|enco|encod|encode|encoded|encodedc|encodedco|encodedcom\S+)\s+"
| table _time, host, user dvc, dvc_nt_host, event_id, eventtype, host, index, parameters,
process, process_id, process_name, process_path, shell, signature_id, source, sourcetype,
src_user, tag, user, user_id | rex field=process "(?<base64_cmd>\w{20,1000}=?)"
| where match(process_name, "(?i)powershell")| avlbase64 type=decode field=base64_cmd
| eval definition=strftime(_time, "%Y-%m-%d %X").": A Base64 Encrypted PowerShell
command was possibly ran on ".dvc_nt_host `hec_collect`'
techniques:
- defense-evasion:obfuscated files or information
- execution:command and scripting interpreter:powershell
technique_id:
- T1027
- T1059.001
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ("EventCode=4688" OR "EventID>4688<") (TERM(-e) OR TERM(-ec) OR TERM(-en) OR TERM(-enc) OR TERM(-enco) OR TERM(-encod) OR TERM(-encode) OR TERM(-encoded) OR TERM(-encodedc) OR TERM(-encodedco) OR TERM(-encodedcommand) OR "-encodedcom*")
Stage 2: regex
| regex process="(?i)powershell.*\s+-(e|en|ec|enco|encod|encode|encoded|encodedc|encodedco|encodedcom\S+)\s+"
Stage 3: table
| table _time, host, user dvc, dvc_nt_host, event_id, eventtype, host, index, parameters, process, process_id, process_name, process_path, shell, signature_id, source, sourcetype, src_user, tag, user, user_id
Stage 4: rex
| rex field=process "(?<base64_cmd>\w{20,1000}=?)"
Stage 5: where
| where match(process_name, "(?i)powershell")
Stage 6: search
| avlbase64 type=decode field=base64_cmd
Stage 7: eval
| eval definition=strftime(_time, "%Y-%m-%d %X").": A Base64 Encrypted PowerShell command was possibly ran on ".dvc_nt_host `hec_collect`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
field | eq |
|
process | regex_match |
|
process_name | match |
|
type | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "EventCode=4688" |
| 1 | "EventID>4688<" |
| 1 | "-e" |
| 1 | "-ec" |
| 1 | "-en" |
| 1 | "-enc" |
| 1 | "-enco" |
| 1 | "-encod" |
| 1 | "-encode" |
| 1 | "-encoded" |
| 1 | "-encodedc" |
| 1 | "-encodedco" |
| 1 | "-encodedcommand" |
| 1 | "-encodedcom*" |
| 6 | avlbase64 |