name: Powershell Processing Stream Of Data
id: 0d718b52-c9f1-11eb-bc61-acde48001122
version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
  via EventCode 4104 that is processing compressed stream data. This is typically
  found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files
  that are stream flattened and will be deflated durnig execution. During triage,
  review parallel processes within the same timeframe. Review the full script block
  to identify other related artifacts.
search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
  OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell may used this function to process compressed data.
references:
- https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
  analytic_story:
  - Malicious PowerShell
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1059.001
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - Message
  - ComputerName
  - User
  - Score
  security_domain: endpoint
  impact: 50 
  confidence: 80  
  # (impact * confidence)/100
  risk_score: 40 
  context:
  - source:endpoint
  - stage: Defense Evasion
  message: A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ 
  observable:
  - name: ComputerName
    type: Hostname
    role:
    - Victim
  - name: User
    type: User
    role:
    - Victim