PowerShell Script Block Initial Analytics

detections/endpoint/detect_empire_with_powershell_script_block_logging.yml

@@ -0,0 +1,48 @@
+name: Detect Empire with PowerShell Script Block Logging
+id: bc1dc6b8-c954-11eb-bade-acde48001122
+version: 1
+date: '2021-06-09'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval empire=if(match(lower(Message),"system.net.webclient") AND  match(lower(Message), "frombase64string") ,1,0)
+  | addtotals fieldname=Score empire
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by empire OpCode ComputerName User EventCode Message
+  | where empire = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `detect_empire_with_powershell_script_block_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+  - https://github.com/BC-SECURITY/Empire
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint

detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml

@@ -0,0 +1,47 @@
+name: Detect Mimikatz With PowerShell Script Block Logging
+id: 8148c29c-c952-11eb-9255-acde48001122
+version: 1
+date: '2021-06-09'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval mimikatz=if(match(lower(Message),"mimikatz") OR match(lower(Message), "-dumpcr") OR match(lower(Message), "sekurlsa::pth") OR match(lower(Message), "kerberos::ptt") OR match(lower(Message), "kerberos::golden") ,1,0)
+  | addtotals fieldname=Score mimikatz
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by mimikatz OpCode ComputerName User EventCode Message
+  | where mimikatz = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `detect_mimikatz_with_powershell_script_block_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint

detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml

@@ -0,0 +1,50 @@
+name: Powershell Fileless Process Injection (GetProcAddress)
+id: a26d9db4-c883-11eb-9d75-acde48001122
+version: 1
+date: '2021-06-08'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies `GetProcAddress` in the script block. This is not normal to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack toolkits use GetProcAddress to obtain code execution. \
+
+  In use, `$var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))` and later referenced/executed elsewhere. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval getproc=if(match(lower(Message),"getprocaddress"),1,0) 
+  | addtotals fieldname=Score getproc
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by getproc OpCode ComputerName User EventCode Message
+  | where getproc = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `powershell_fileless_process_injection_(getprocaddress)_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Limited false positives. Filter as needed.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint

detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml

@@ -0,0 +1,51 @@
+name: Powershell Fileless Script Contains Base64 Encoded Content
+id: 8acbc04c-c882-11eb-b060-acde48001122
+version: 1
+date: '2021-06-08'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \
+
+  Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String('38uqIyMjQ6rG....` \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval Encode=if(match(lower(Message),"frombase64string"),1,0) 
+  | addtotals fieldname=Score Encode
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by Encode OpCode ComputerName User EventCode Message
+  | where Encode = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `powershell_fileless_script_contains_base64_encoded_content_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited. Filter as needed.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1027
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint

detections/endpoint/unloading_amsi_via_reflection.yml

@@ -0,0 +1,47 @@
+name: Unloading AMSI via Reflection
+id: a21e3484-c94d-11eb-b55b-acde48001122
+version: 1
+date: '2021-06-09'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe('System.Management.Automation.Amsi'+'Utils')` taken from Powershell-Empire. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval amsi=if(match(lower(Message),"system.management.automation.amsi"),1,0) 
+  | addtotals fieldname=Score amsi
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by amsi OpCode ComputerName User EventCode Message
+  | where amsi = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `unloading_amsi_via_reflection_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Potential for some third party applications to disable AMSI upon invocation. Filter as needed.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint

tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml

@@ -0,0 +1,12 @@
+name: Detect Empire with PowerShell Script Block Logging Unit Test
+tests:
+- name: Detect Empire with PowerShell Script Block Logging
+  file: endpoint/detect_empire_with_powershell_script_block_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml

@@ -0,0 +1,12 @@
+name: Detect Mimikatz With PowerShell Script Block Logging Unit Test
+tests:
+- name: Detect Mimikatz With PowerShell Script Block Logging
+  file: endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/powershell_fileless_process_injection_(getprocaddress).test.yml

@@ -0,0 +1,12 @@
+name: Powershell Fileless Process Injection (GetProcAddress) Unit Test
+tests:
+- name: Powershell Fileless Process Injection (GetProcAddress)
+  file: endpoint/powershell_fileless_process_injection_(getprocaddress).yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml

@@ -0,0 +1,12 @@
+name: Powershell Fileless Script Contains Base64 Encoded Content Unit Test
+tests:
+- name: Powershell Fileless Script Contains Base64 Encoded Content
+  file: endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/unloading_amsi_via_reflection.test.yml

@@ -0,0 +1,12 @@
+name: Unloading AMSI via Reflection Unit Test
+tests:
+- name: Unloading AMSI via Reflection
+  file: endpoint/unloading_amsi_via_reflection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog