admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

xworm

Browse Source
This commit is contained in:
Teoderick Contreras
2025-05-08 20:28:47 +02:00
parent dfac5c5239
commit bf250fe4e3
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
+3 -2
View File
@@ -15,7 +15,8 @@ description: The following analytic detects the use of PowerShell scripts to loa
to execute code in memory, bypassing traditional defenses. If confirmed malicious,
this activity could lead to unauthorized code execution, privilege escalation, and
persistent access within the environment.
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Reflection.Assembly]::Load*",
search: |
`powershell` EventCode=4104 ScriptBlockText IN ("*Reflection.Assembly]::Load*",
"*Reflection.Assembly.Load*", "*UnsafeLoadFrom*", "*.LoadFrom(*", "*.LoadModule(*",
"*.LoadWithPartialName*", "*ReflectionOnlyLoad*", "*Reflection.Assembly]::('daoL'[-1..-4] -join '')*")
| fillnull
@@ -23,7 +24,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Reflection.Assembly]:
by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `powershell_loading_dotnet_into_memory_via_reflection_filter`'
| `powershell_loading_dotnet_into_memory_via_reflection_filter`
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.