name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7
version: 1
date: '2020-11-05'
author: Stanislav Miskovic, Splunk
type: streaming
datamodel: []
description: This detection identifies use of PowerSploit modules that discover opportunities
  for malicious access and persistence. Some examples include access to admin accounts,
  weak access control policies, landing paths for dropping malicious software or data
  to exfiltrate, registry locations to land autorun parameters, task scheduling opportunities,
  as well as services and system files that can be compromised.
search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line,
  /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true
  OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line,
  /(?i)Find-ProcessDLLHijack/)=true OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true
  OR match_regex(cmd_line, /(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true
  OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line,
  /(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true
  OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line,
  /(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true
  OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line,
  /(?i)Get-UnquotedService/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
  "string", null)), body = "TBD" | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
references:
- https://github.com/PowerShellMafia/PowerSploit
tags:
  analytic_story:
  - Windows Discovery Techniques
  asset_type: Windows
  cis20:
  - CIS 16
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1053
  - T1068
  - T1078
  - T1543
  - T1547
  - T1574
  nist:
  - PR.AC
  - PR.IP
  product:
  - UEBA for Security Cloud
  required_fields:
  - _time
  - process
  - dest_device_id
  - dest_user_id
  risk_severity: high
  security_domain: endpoint
