Suspicious reCAPTCHA Command Line (PowerShell)

id: '41487.76910'
title: Suspicious reCAPTCHA Command Line
description: This use case detects commonly abused LOLBAS utilities referencing reCAPTCHA
  in the command line.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR (TERM(EventCode=4104) OR "<EventID>4104<")) (TERM(reCAPTCHA)
  OR TERM(robot) OR TERM(human)) | where match(process, "(?i)\sreCAPTCHA\s|I\s+am\s+not\s+a\s+robot|Verify\s+you\s+are\s+human")
  | table _time, host, user parent_*, process_*, process| bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- execution:command and scripting interpreter
technique_id: 
- T1218
- T1059
data_category:
- PowerShell logs
references:
- https://www.reliaquest.com/blog/using-captcha-for-compromise/
- https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection