asset_type: Endpoint
confidence: medium
creation_date: '2018-03-19'
data_metadata:
  data_models:
    - Endpoint
  data_source:
    - Endpoint Intel
  providing_technologies:
    - Carbon Black Response
    - CrowdStrike Falcon
    - Sysmon
    - Tanium
    - Ziften
description: This search looks for PowerShell processes started with parameters used
  to bypass the local execution policy for scripts. These parameters are often observed
  in attacks leveraging PowerShell scripts as they override the default PowerShell
  execution policy.
detect:
  splunk:
    correlation_rule:
      notable:
        drilldown_name: View powershell process information on $dest$
        drilldown_search: '| from datamodel:Endpoint.Processes | search dest="$dest$" process_id=$process_id$'
        nes_fields: dest, user, process_name
        rule_description: The system $dest$ executed a PowerShell process with parameters
          to bypass the local execution policy.
        rule_title: PowerShell process with -executionpolicy bypass detected on $dest$
      risk:
        risk_object: dest
        risk_object_type:
          - system
        risk_score: 50
      schedule:
        cron_schedule: 50 * * * *
        earliest_time: -70m@m
        latest_time: -10m@m
      search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, 
        values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process
        min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
        where Processes.process_name=powershell.exe AND (Processes.process="* -ex*" OR Processes.process="* bypass *") by
        Processes.process_id, Processes.user, Processes.dest 
        | `drop_dm_object_name(Processes)` 
        | `security_content_ctime(firstTime)` 
        | `security_content_ctime(lastTime)`'
      suppress:
        suppress_fields: dest, process_name
        suppress_period: 14400s
eli5: This search looks for PowerShell processes that were launched using a parameter
  designed to bypass the local PowerShell execution policy. By default, the policy
  is set to "Restricted," which disables the execution of PowerShell scripts. In environments
  that make heavy use of PowerShell, the policy can be set to allow only scripts signed
  by a trusted publisher. Malicious PowerShell use almost always includes the parameter
  `-ExecutionPolicy bypass`. PowerShell is very liberal when it comes to interpreting
  command-line parameters passed to it. For example, the parameter we look for, `-ExecutionPolicy`,
  can be abbreviated to `-Execution`, `-Exec`, or even `-ex`. As such, we look for
  `* -ex*`, which should catch all variations of this parameter, followed by the keyword
  `bypass`. This search will return the host, the user the process ran under, the
  process and its command-line arguments, the number of times it has seen this process,
  and the first and last times it saw this process.
entities:
  - dest
  - process_id
  - process
  - parent_process_id
how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must also be
  ingesting logs with both the process name and command line from your endpoints.
  The command-line arguments are mapped to the "process" field in the Endpoint data
  model.
id: 9be56c82-b1cc-4318-87eb-d138afaaca39
investigations:
  - id: d8362a34-b78a-4364-9733-59b505f5b8d5
    name: Get Process Registry Activity
    type: splunk
  - id: 6a9ad4d9-6ef2-4b85-953f-a37ab256acd5
    name: Get Process File Activity
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
    name: Get Authentication Logs For Endpoint
    type: splunk
  - id: fecf2918-670d-4f1c-872b-3d7317a41bf9
    name: Get Parent Process Info
    type: splunk
  - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
    name: Get Notable Info
    type: splunk
known_false_positives: There may be legitimate reasons to bypass the PowerShell execution
  policy. The PowerShell script being run with this parameter should be validated
  to ensure that it is legitimate.
maintainers:
  - company: Splunk
    email: rvaldez@splunk.com
    name: Rico Valdez
mappings:
  cis20:
    - CIS 3
    - CIS 7
    - CIS 8
  kill_chain_phases:
    - Command and Control
    - Actions on Objectives
  mitre_attack:
    - Execution
    - PowerShell
    - Scripting
  nist:
    - PR.PT
    - DE.CM
    - PR.IP
modification_date: '2018-12-03'
name: Malicious PowerShell Process - Execution Policy Bypass
original_authors:
  - company: Splunk
    email: rvaldez@splunk.com
    name: Rico Valdez
references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '3.0'