Potential Target Discovery via PowerShell Event Log Queries (PowerShell)

id: '19995.35576'
title: Potential Target Discovery via PowerShell Event Log Queries
description: 'Threat actors may use custom scripts during discovery activities to
  identify targets on a network. This use case detects PowerShell scripts querying
  System, Security, and Windows Terminal Services event logs as observed with RagnarLocker.
  -- Threat Actor Association: APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard,
  Pawn Storm, TA422, STRONTIUM) - Software Association: RagnarLocker'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" TERM(EventCode=4104) OR "<EventID>4104<") (TERM(Get-EventLog) OR
  TERM(Get-WinEvent)) ("7001" OR "7002" OR "21" OR "25" OR "4624") | table _time,
  host, user process, process_*, signature_id | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- discovery:system information discovery
technique_id: 
- T1082
data_category:
- PowerShell logs
references:
- https://blog.sygnia.co/threat-actor-spotlight-ragnarlocker-ransomware?_ga=2.100185502.1673284611.1684933734-1923873697.1682517767
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/