name: Suspicious Powershell Command-Line Arguments
id: 2cdb91d2-542c-497f-b252-be495e71f38c
version: 6
date: '2021-01-19'
author: David Dorsey, Splunk
type: TTP
datamodel:
- Endpoint
description: This search looks for PowerShell processes started with a base64 encoded
  command-line passed to it, with parameters to modify the execution policy for the
  process, and those that prevent the display of an interactive prompt to the user.
  This combination of command-line options is suspicious because it overrides the
  default PowerShell execution policy, attempts to hide itself from the user, and
  passes an encoded script to be run on the command-line. Deprecated because almost
  the same as Malicious PowerShell Process - Encoded Command
search: '| tstats `security_content_summariesonly` count values(Processes.process)
  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
  search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `suspicious_powershell_command_line_arguments_filter`'
how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must also be
  ingesting logs with both the process name and command line from your endpoints.
  The command-line arguments are mapped to the "process" field in the Endpoint data
  model.
known_false_positives: Legitimate process can have this combination of command-line
  options, but it's not common.
references: []
tags:
  analytic_story:
  - Malicious PowerShell
  - Hermetic Wiper 
  - CISA AA22-320A
  asset_type: Endpoint
  cis20:
  - CIS 3
  - CIS 7
  - CIS 8
  kill_chain_phases:
  - Command & Control
  - Actions on Objectives
  mitre_attack_id:
  - T1059.001
  nist:
  - PR.PT
  - DE.CM
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  security_domain: endpoint
  confidence: 50
  impact: 50
  risk_score: 25
  context:
  - Unknown
  message: tbd
  observable:
  - name: field
    type: Unknown
    role:
    - Unknown