admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inRemote Process Instantiation via WinRM and PowerShell Script Block

Browse Source
This commit is contained in:
root
2021-11-17 18:00:10 +00:00
parent 4f356d3398
commit a442e207fe
1 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+12 -10
View File
@@ -7,18 +7,19 @@ type: TTP
datamodel:
- Endpoint
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint
by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
Red Teams and adversaries alike may abuse WinRM for lateral movement and remote code execution.
to identify the execution of PowerShell with arguments utilized to start a process
on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks
for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike
may abuse WinRM for lateral movement and remote code execution.
search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process
on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts
or users.
PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
a process on remote systems for system administration or automation use cases. However,
this activity is usually limited to a small set of hosts or users.
references:
- https://attack.mitre.org/techniques/T1021/006/
- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
@@ -49,10 +50,11 @@ tags:
context:
- Source:Endpoint
- Stage:Lateral Movement
message: A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe
message: A process was started on a remote endpoint from $ComputerName by abusing
WinRM using PowerShell.exe
observable:
- name: ComputerName
type: Endpoint
role:
- Victim
automated_detection_testing: passed