Detection rules › Splunk
Suspicious PowerShell Parameter Substring (PowerShell)
Threat actors may use obfuscated and truncated PowerShell execution arguments to evade detection, leveraging PowerShell's parameter binding functionality that allows partial matching of command-line arguments. This use case detects process executions containing substrings for commonly abused PowerShell parameters.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
id: '30388.54741'
title: Suspicious PowerShell Parameter Substring
description: Threat actors may use obfuscated and truncated PowerShell execution arguments
to evade detection, leveraging PowerShell's parameter binding functionality that
allows partial matching of command-line arguments. This use case detects process
executions containing substrings for commonly abused PowerShell parameters.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
"<EventID>4104<") " -windowstyl " OR " -windowsty " OR " -windowst " OR " -windows
" OR " -windo " OR " -wind " OR " -win " OR " -wi" OR ((" -executionpolic " OR "
-executionpoli " OR " -executionpol " OR " -executionpo " OR " -executionp " OR
" -execution " OR " -executio " OR " -executi " OR " -execut " OR " -execu " OR
" -exec " OR " -exe " OR " -ex") "bypass") OR " -NoPr " OR " -NoPro " OR " -NoProf
" OR " -NoProfi " OR " -NoProfil " OR " -nonin " OR " -nonint " OR " -noninte "
OR " -noninter " OR " -nonintera " OR " -noninterac " OR " -noninteract " OR " -noninteracti
" OR " -noninteractiv " OR " -ec " OR " -encodedComman " OR " -encodedComma " OR
" -encodedComm " OR " -encodedCom " OR " -encodedCo " OR " -encodedC " OR " -encoded
" OR " -encode " OR " -encod " OR " -enco " OR " -en " OR (" /windowstyle " OR "
/windowstyl " OR " /windowsty " OR " /windowst " OR " /windows " OR " /windo " OR
" /wind " OR " /win " OR " /wi") OR ((" /executionpolic " OR " /executionpoli "
OR " /executionpol " OR " /executionpo " OR " /executionp " OR " /execution " OR
" /executio " OR " /executi " OR " /execut " OR " /execu " OR " /exec " OR " /exe
" OR " /ex") "bypass") OR " /NoPr " OR " /NoPro " OR " /NoProf " OR " /NoProfi "
OR " /NoProfil " OR " /nonin " OR " /nonint " OR " /noninte " OR " /noninter " OR
" /nonintera " OR " /noninterac " OR " /noninteract " OR " /noninteracti " OR "
/noninteractiv " OR " /ec " OR " /encodedComman " OR " /encodedComma " OR " /encodedComm
" OR " /encodedCom " OR " /encodedCo " OR " /encodedC " OR " /encoded " OR " /encode
" OR " /encod " OR " /enco " OR " /en" | regex process="(?i)\s(-|\/)(win?d?o?w?s?t?y?l?\s+hi?d?d?e?|windowstyle\s+h\s|NoPro?f?i?l?\s|nonint?e?r?a?c?t?i?v?\s|enc?o?d?e?d?C?o?m?m?a?n?\s|((exe?c?u?t?i?o?n?p?o?l?i?c?)|ep)\s+(bypass)?|ec\s)"
| table _time, host, user process, process_*, signature_id | bin span=1s | stats
values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- PowerShell logs
references:
- http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
- https://github.com/SigmaHQ/sigma/blob/c0332a9d96f6c7804fcc85dd706caed889446a62/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR "<EventID>4104<") " -windowstyl " OR " -windowsty " OR " -windowst " OR " -windows " OR " -windo " OR " -wind " OR " -win " OR " -wi" OR ((" -executionpolic " OR " -executionpoli " OR " -executionpol " OR " -executionpo " OR " -executionp " OR " -execution " OR " -executio " OR " -executi " OR " -execut " OR " -execu " OR " -exec " OR " -exe " OR " -ex") "bypass") OR " -NoPr " OR " -NoPro " OR " -NoProf " OR " -NoProfi " OR " -NoProfil " OR " -nonin " OR " -nonint " OR " -noninte " OR " -noninter " OR " -nonintera " OR " -noninterac " OR " -noninteract " OR " -noninteracti " OR " -noninteractiv " OR " -ec " OR " -encodedComman " OR " -encodedComma " OR " -encodedComm " OR " -encodedCom " OR " -encodedCo " OR " -encodedC " OR " -encoded " OR " -encode " OR " -encod " OR " -enco " OR " -en " OR (" /windowstyle " OR " /windowstyl " OR " /windowsty " OR " /windowst " OR " /windows " OR " /windo " OR " /wind " OR " /win " OR " /wi") OR ((" /executionpolic " OR " /executionpoli " OR " /executionpol " OR " /executionpo " OR " /executionp " OR " /execution " OR " /executio " OR " /executi " OR " /execut " OR " /execu " OR " /exec " OR " /exe " OR " /ex") "bypass") OR " /NoPr " OR " /NoPro " OR " /NoProf " OR " /NoProfi " OR " /NoProfil " OR " /nonin " OR " /nonint " OR " /noninte " OR " /noninter " OR " /nonintera " OR " /noninterac " OR " /noninteract " OR " /noninteracti " OR " /noninteractiv " OR " /ec " OR " /encodedComman " OR " /encodedComma " OR " /encodedComm " OR " /encodedCom " OR " /encodedCo " OR " /encodedC " OR " /encoded " OR " /encode " OR " /encod " OR " /enco " OR " /en"
Stage 2: regex
| regex process="(?i)\s(-|\/)(win?d?o?w?s?t?y?l?\s+hi?d?d?e?|windowstyle\s+h\s|NoPro?f?i?l?\s|nonint?e?r?a?c?t?i?v?\s|enc?o?d?e?d?C?o?m?m?a?n?\s|((exe?c?u?t?i?o?n?p?o?l?i?c?)|ep)\s+(bypass)?|ec\s)"
Stage 3: table
| table _time, host, user process, process_*, signature_id
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4104<" |
| 1 | " -windowstyl " |
| 1 | " -windowsty " |
| 1 | " -windowst " |
| 1 | " -windows " |
| 1 | " -windo " |
| 1 | " -wind " |
| 1 | " -win " |
| 1 | " -wi" |
| 1 | " -executionpolic " |
| 1 | " -executionpoli " |
| 1 | " -executionpol " |
| 1 | " -executionpo " |
| 1 | " -executionp " |
| 1 | " -execution " |
| 1 | " -executio " |
| 1 | " -executi " |
| 1 | " -execut " |
| 1 | " -execu " |
| 1 | " -exec " |
| 1 | " -exe " |
| 1 | " -ex" |
| 1 | "bypass" |
| 1 | " -NoPr " |
| 1 | " -NoPro " |
| 1 | " -NoProf " |
| 1 | " -NoProfi " |
| 1 | " -NoProfil " |
| 1 | " -nonin " |
| 1 | " -nonint " |
| 1 | " -noninte " |
| 1 | " -noninter " |
| 1 | " -nonintera " |
| 1 | " -noninterac " |
| 1 | " -noninteract " |
| 1 | " -noninteracti " |
| 1 | " -noninteractiv " |
| 1 | " -ec " |
| 1 | " -encodedComman " |
| 1 | " -encodedComma " |
| 1 | " -encodedComm " |
| 1 | " -encodedCom " |
| 1 | " -encodedCo " |
| 1 | " -encodedC " |
| 1 | " -encoded " |
| 1 | " -encode " |
| 1 | " -encod " |
| 1 | " -enco " |
| 1 | " -en " |
| 1 | " /windowstyle " |
| 1 | " /windowstyl " |
| 1 | " /windowsty " |
| 1 | " /windowst " |
| 1 | " /windows " |
| 1 | " /windo " |
| 1 | " /wind " |
| 1 | " /win " |
| 1 | " /wi" |
| 1 | " /executionpolic " |
| 1 | " /executionpoli " |
| 1 | " /executionpol " |
| 1 | " /executionpo " |
| 1 | " /executionp " |
| 1 | " /execution " |
| 1 | " /executio " |
| 1 | " /executi " |
| 1 | " /execut " |
| 1 | " /execu " |
| 1 | " /exec " |
| 1 | " /exe " |
| 1 | " /ex" |
| 1 | "bypass" |
| 1 | " /NoPr " |
| 1 | " /NoPro " |
| 1 | " /NoProf " |
| 1 | " /NoProfi " |
| 1 | " /NoProfil " |
| 1 | " /nonin " |
| 1 | " /nonint " |
| 1 | " /noninte " |
| 1 | " /noninter " |
| 1 | " /nonintera " |
| 1 | " /noninterac " |
| 1 | " /noninteract " |
| 1 | " /noninteracti " |
| 1 | " /noninteractiv " |
| 1 | " /ec " |
| 1 | " /encodedComman " |
| 1 | " /encodedComma " |
| 1 | " /encodedComm " |
| 1 | " /encodedCom " |
| 1 | " /encodedCo " |
| 1 | " /encodedC " |
| 1 | " /encoded " |
| 1 | " /encode " |
| 1 | " /encod " |
| 1 | " /enco " |
| 1 | " /en" |