Detection rules › Splunk
Suspicious Powershell (PowerShell)
PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary. This use case attempts to identify those powershell executions launched by a binary other than powershell
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
Rule body yaml
id: '6000.6379'
title: Suspicious Powershell
description: 'PowerShell commands/scripts can also be executed without directly invoking
the powershell.exe binary. This use case attempts to identify those powershell executions
launched by a binary other than powershell. -- Threat Actor Association: APT35/Charming
Kitten/Phosphorus, TA576 - Software Association: BATLoader, XWorm'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4103) NOT
powershell.exe | rex field=Message "(?i)host\s+application\s+\=(?<process_path1>.+?\.exe")|
where isnotnull(process_path1)| regex process_path1!="(?i)powershell(\_ISE)?\.exe"
| eval process_path=mvappend(process_path, process_path1) | table _time, host, user,
event_id, signature_id, process_*, process | bin span=10s | stats values(*) as *
by _time, host, process_path1 '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/fdiskyou/PowerOPS
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4103) NOT powershell.exe
Stage 2: eval
| rex field=Message "(?i)host\s+application\s+\=(?<process_path1>.+?\.exe")
Stage 3: where
| where isnotnull(process_path1)
Stage 4: regex
| regex process_path1!="(?i)powershell(\_ISE)?\.exe"
Stage 5: eval
| eval process_path=mvappend(process_path, process_path1)
Stage 6: table
| table _time, host, user, event_id, signature_id, process_*, process
Stage 7: bucket
| bin span=10s
Stage 8: stats
| stats values(*) as * by _time, host, process_path1
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
process_path1 | regex_match | "(?i)powershell(\_ISE)?.exe" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
process_path1 | is_not_null |
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | powershell.exe |