Potential PowerShell Post-Exploitation Activity (Sysmon)

id: '27535.50074'
title: Potential PowerShell Post-Exploitation Activity
description: 'Threat actors may perform post-exploitation activities using PowerShell
  scripts such as ADRecon. When running ADRecon, PowerShell launches child processes
  to compile and execute payloads and creates several .cmdline files in AppData\Local\Temp
  directories. This use case detects PowerShell-invoked compilations involving csc.exe
  and cvtres.exe referencing multiple .cmdline files from temp directories within
  a 5 minute time period. This may that a malicious script like ADRecon has been executed,
  regardless of the script title name or cmdlets invoked. Atomics T1087.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("powershell.exe" OR "pwsh.exe") ("csc.exe" OR "cvtres.exe") ".cmdline" | regex
  parent_process_name="(?i)(powershell|pwsh)\.exe"| regex process_name="(?i)(csc|cvtres)\.exe"|
  regex process="(?i)\x5cAppData\x5cLocal\x5cTemp.+\.cmdline" | table _time, host,
  user process, parent_process_name, event_count | bin span=300s | stats values(*)
  as * by _time, host | eventstats dc(process) as dc_process by host, _time| where
  dc_process > 3 '
techniques:
- execution:command and scripting interpreter:powershell
- discovery:account discovery
- discovery:system information discovery
technique_id:
- T1059.001
- T1087
- T1082
data_category:
- Windows Sysmon
references:
- https://github.com/sense-of-security/ADRecon/tree/master
- https://www.dnif.it/en/blog/strategies-to-detect-post-exploitation-active-directory-reconnaissance
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker