From 16218d8d85f15524cc9794bb7fcf76cbec30fc9a Mon Sep 17 00:00:00 2001 From: root Date: Wed, 17 Nov 2021 17:38:32 +0000 Subject: [PATCH] Added detection testing service results inRemote Process Instantiation via WMI and PowerShell Script Block --- ...on_via_wmi_and_powershell_script_block.yml | 28 ++++++++++--------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index 62cf565e54..7307c4ff74 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -7,19 +7,19 @@ type: TTP datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint - by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote - code execution. + to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized + to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries + alike may abuse WMI and this commandlet for lateral movement and remote code execution. search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*" - AND Message="*-Class Win32_Process*" AND Message="*-Name create*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' + AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count + min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process - on remote systems, but this activity is usually limited to a small set of hosts - or users. + PowerShell Script Block Logging on some or all endpoints. Additional setup instructions + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators may leverage WWMI and powershell.exe to start + a process on remote systems, but this activity is usually limited to a small set + of hosts or users. references: - https://attack.mitre.org/techniques/T1047/ - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 @@ -49,9 +49,11 @@ tags: context: - Source:Endpoint - Stage:Lateral Movement - message: A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe + message: A process was started on a remote endpoint from $ComputerName by abusing + WMI using PowerShell.exe observable: - name: ComputerName type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed