Powershell DLL_EXE Injection (PowerShell)

id: '1082.1121'
title: Powershell DLL_EXE Injection
description: 'DLL injection simply refers to the (forced) injection of a DLL into
  the space of another process and then execution of its code.What makes Reflective
  DLL Injection different? The DLL injection code and the source of the DLL are obtained
  via its full path on disk. Because of this, it is not considered a very stealthy
  approach and also has an external dependency which may be problematic should it
  ever be separated. These issues can be addressed by using Reflective DLL Injection
  which allows the sourcing of the DLL in the form of its raw data. Threat Actor Association:
  Carbanak, TA2541, TA551 Software Association: IcedID'
logic_format: Splunk
logic: '`get_endpoint_data``get_endpoint_data_powershell` TERM(EventCode=4104) ("VirtualAlloc"
  OR "VirtualAllocEx" OR "WriteProcessMemory" OR "CreateRemoteThread" OR "VirtualFree"
  OR "CreateThread" OR "System.Diagnostics.Process") | rex field=_raw (?<Keywords_1>"(?i)VirtualAlloc(Ex)?")|
  rex field=_raw (?<Keywords_2>"(?i)WriteProcessMemory")| rex field=_raw (?<Keywords_3>"(?i)CreateRemoteThread")|
  rex field=_raw (?<Keywords_4>"(?i)VirtualFree")| rex field=_raw (?<Keywords_5>"(?i)CreateThread")|
  rex field=Message max_match=5 "(?i)System\.Diagnostics\.Process\s+\W?(?<injected_process>((\w+\-){1,})?\w+)"|
  rex field=_raw max_match=0 (?<script>"(?i)((\w+\-){1,})?\w+\.ps1")| eval keywords=mvappend(Keywords_1,
  Keywords_2, Keywords_3, Keywords_4, Keywords_5)| table _time, host, user event_id,
  keywords, process, process_*, signature_id, user, user_id, script, injected_process
  | bin span=15s | stats values(*) as * by _time, host |where (match(process, "(?i)VirtualAlloc(Ex)?")
  AND match(process, "(?i)WriteProcessMemory|virtualfree") AND match(process, "(?i)CreateRemoteThread|Createthread")) '
techniques:
- privilege-escalation:process injection:dynamic-link library injection
technique_id:
- T1055.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://attack.mitre.org/techniques/T1055/001/