Detection rules › Splunk
Obfuscated Powershell Techniques (PowerShell)
Attackers and commodity malware have started using extremely basic obfuscation techniques to hide the majority of the command from the command line arguments of powershell.exe. This use case relies on URL Toolbox to function
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1027 Obfuscated Files or Information |
| Command & Control | T1001 Data Obfuscation |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
Rule body yaml
id: '5869.6200'
title: Obfuscated Powershell Techniques
description: 'Attackers and commodity malware have started using extremely basic obfuscation
techniques to hide the majority of the command from the command line arguments of
powershell.exe. This use case relies on URL Toolbox to function. -- Software Association:
AsyncRAT, Midas --'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` EventCode=4103 (Invoke-Expression
OR Invoke-Command OR Invoke-WebRequest)| rex field=Message "(?i)\"Command\"\;\svalue=\"?(?<obfuscated_cmd>.+.\)?\")"
| rex field=Message "(?i)script\s+name\s+?\=(?<script_name>.+\.ps1)" | regex obfuscated_cmd!="(?i)(\.ps1|powershell)"|
regex obfuscated_cmd=".{25,}" |`ut_shannon(obfuscated_cmd)` | table _time, host,
user process, process_*, signature_id, user, obfuscated_cmd, ut_shannon, script_name
| bin span=1s | stats values(*) as * by _time, host | where ut_shannon > 4 OR match(obfuscated_cmd,
"\s{30}") OR match(obfuscated_cmd, "\W{30}") OR (match(obfuscated_cmd, "(\s?\d{1,8}(\s+|\,)(\s+|\,)?){15}"))
OR match(obfuscated_cmd, "(?i)bxor") '
techniques:
- defense-evasion:obfuscated files or information
- command-and-control:data obfuscation
technique_id:
- T1027
- T1001
data_category:
- Windows event logs
- PowerShell logs
references:
- https://github.com/danielbohannon/Invoke-Obfuscation
- https://github.com/oddcod3/Phantom-Evasion
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` EventCode=4103 (Invoke-Expression OR Invoke-Command OR Invoke-WebRequest)
Stage 2: rex
| rex field=Message "(?i)\"Command\"\;\svalue=\"?(?<obfuscated_cmd>.+.\)?\")"
Stage 3: rex
| rex field=Message "(?i)script\s+name\s+?\=(?<script_name>.+\.ps1)"
Stage 4: regex
| regex obfuscated_cmd!="(?i)(\.ps1|powershell)"
Stage 5: regex
| regex obfuscated_cmd=".{25,}"
Stage 6: search
| `ut_shannon(obfuscated_cmd)`
Stage 7: table
| table _time, host, user process, process_*, signature_id, user, obfuscated_cmd, ut_shannon, script_name
Stage 8: bucket
| bin span=1s
Stage 9: stats
| stats values(*) as * by _time, host
Stage 10: where
| where ut_shannon > 4 OR match(obfuscated_cmd, "\s{30}") OR match(obfuscated_cmd, "\W{30}") OR (match(obfuscated_cmd, "(\s?\d{1,8}(\s+|\,)(\s+|\,)?){15}")) OR match(obfuscated_cmd, "(?i)bxor")
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
obfuscated_cmd | regex_match | "(?i)(.ps1|powershell)" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
obfuscated_cmd | match |
|
obfuscated_cmd | regex_match |
|
ut_shannon | gt |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | Invoke-Expression |
| 1 | Invoke-Command |
| 1 | Invoke-WebRequest |