name: Powershell Execute COM Object
id: 65711630-f9bf-11eb-8d72-acde48001122
version: 2
date: '2023-04-14'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: This search is to detect a COM CLSID execution through powershell. This
  technique was seen in several adversaries and malware like ransomware conti where
  it has a feature to execute command using COM Object. This technique may use by
  network operator at some cases but a good indicator if some application want to
  gain privilege escalation or bypass uac.
data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*CreateInstance([type]::GetTypeFromCLSID*"
  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
  Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `powershell_execute_com_object_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA.
known_false_positives: network operrator may use this command.
references:
- https://threadreaderapp.com/thread/1423361119926816776.html
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
  analytic_story:
  - Ransomware
  - Malicious PowerShell
  - Hermetic Wiper
  - Data Destruction
  asset_type: Endpoint
  confidence: 50
  impact: 10
  message: A suspicious powershell script contains COM CLSID command in $ScriptBlockText$
    with EventCode $EventCode$ in host $Computer$
  mitre_attack_id:
  - T1546.015
  - T1546
  - T1059.001
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - ScriptBlockText
  - Computer
  - EventCode
  risk_score: 5
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log
    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
    sourcetype: xmlwineventlog