Detection rules › Splunk
Suspicious Powershell (PowerShell)
PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary. This use case attempts to identify those powershell executions launched by a binary other than powershell
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4103: Payload Context: ContextInfo User Data: UserData. |
Rule body
id: '6000.6379'
title: Suspicious Powershell
description: 'PowerShell commands/scripts can also be executed without directly invoking
the powershell.exe binary. This use case attempts to identify those powershell executions
launched by a binary other than powershell. -- Threat Actor Association: APT35/Charming
Kitten/Phosphorus, TA576 - Software Association: BATLoader, XWorm'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4103) NOT
powershell.exe | rex field=Message "(?i)host\s+application\s+\=(?<process_path1>.+?\.exe")|
where isnotnull(process_path1)| regex process_path1!="(?i)powershell(\_ISE)?\.exe"
| eval process_path=mvappend(process_path, process_path1) | table _time, host, user,
event_id, signature_id, process_*, process | bin span=10s | stats values(*) as *
by _time, host, process_path1 '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/fdiskyou/PowerOPS
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4103) NOT powershell.exe
Stage 2: rex
| rex field=Message "(?i)host\s+application\s+\=(?<process_path1>.+?\.exe")
Stage 3: where
| where isnotnull(process_path1)
Stage 4: regex
| regex process_path1!="(?i)powershell(\_ISE)?\.exe"
Stage 5: eval
| eval process_path=mvappend(process_path, process_path1)
Stage 6: table
| table _time, host, user, event_id, signature_id, process_*, process
Stage 7: bucket
| bin span=10s
Stage 8: stats
| stats values(*) as * by _time, host, process_path1
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
process_path1 | regex_match | "(?i)powershell(\_ISE)?.exe" | excludes:process_path1 |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4103" |
process_path1 | is_not_null | field:"process_path1" kind:is_not_null |