From 62ed90ccbd42a9a33400418ca38c574a096b90ec Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Wed, 14 Apr 2021 22:46:38 -0700 Subject: [PATCH 1/2] Added various ways to execute powershell, made match of the powershell executable mandatory, added that execution must be followed by one of the hidding or no-exit options. --- .../endpoint/malicious_powershell_executed_as_a_service.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index c81326e8ff..2a2d57a010 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -8,8 +8,10 @@ datamodel: - Endpoint description: This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. -search: ' `wineventlog_system` EventCode=7045 Service_File_Name IN ("*powershell.exe*", - "*-nop*", "*hid*") | stats count min(_time) as firstTime max(_time) as lastTime +search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) | + regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]" | + regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*" | + stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`' From a0914ddcdd2f1cb5fcd2de33f47ae70d273ff867 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 07:23:08 +0000 Subject: [PATCH 2/2] Added detection testing service results inMalicious Powershell Executed As A Service --- .../malicious_powershell_executed_as_a_service.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index 2a2d57a010..87849d074d 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -8,13 +8,12 @@ datamodel: - Endpoint description: This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. -search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) | - regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]" | - regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*" | - stats count min(_time) as firstTime max(_time) as lastTime - by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account - user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `malicious_powershell_executed_as_a_service_filter`' +search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) + | regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]" + | regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name + Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.