From 6139a30ce777c112ee84ee7094a3524dc84ca021 Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Thu, 15 Apr 2021 15:49:59 -0700 Subject: [PATCH 1/2] Adding a more deterministic matching of command line options. --- .../endpoint/malicious_powershell_executed_as_a_service.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index 87500782d1..aeb26bd70a 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -10,7 +10,7 @@ description: This detection is to identify the abuse the Windows SC.exe to execu malicious commands or payloads via PowerShell. search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) | regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]" - | regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*" + | regex l_Service_File_Name="-nop[rofile\s]+|-w[indowstyle]*\s+hid[den]*|-noe[xit\s]+|-enc[odedcommand\s]+" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`' From d22dc28bab45d4a7481e259df3b964cdb592ad19 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 23 Jun 2021 18:34:30 +0000 Subject: [PATCH 2/2] Added detection testing service results inMalicious Powershell Executed As A Service