From a0914ddcdd2f1cb5fcd2de33f47ae70d273ff867 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 07:23:08 +0000 Subject: [PATCH] Added detection testing service results inMalicious Powershell Executed As A Service --- .../malicious_powershell_executed_as_a_service.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index 2a2d57a010..87849d074d 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -8,13 +8,12 @@ datamodel: - Endpoint description: This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. -search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) | - regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]" | - regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*" | - stats count min(_time) as firstTime max(_time) as lastTime - by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account - user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `malicious_powershell_executed_as_a_service_filter`' +search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) + | regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]" + | regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name + Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.