name: Possible Lateral Movement PowerShell Spawn
id: cb909b3e-512b-11ec-aa31-3e22fbd008af
version: 1
date: '2023-04-14'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: 'The following analytic is designed to identify possible lateral movement
  attacks that involve the spawning of a PowerShell process as a child or grandchild
  process of commonly abused processes. These processes include services.exe, wmiprsve.exe,
  svchost.exe, wsmprovhost.exe, and mmc.exe.\

  Such behavior is indicative of legitimate Windows features such as the Service Control
  Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management,
  and the DCOM protocol being abused to start a process on a remote endpoint. This
  behavior is often seen during lateral movement techniques where adversaries or red
  teams abuse these services for lateral movement and remote code execution.'
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe
  OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe
  OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe)
  (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*)
  OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*))
  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
  and Response (EDR) agents. These agents are designed to provide security-related
  telemetry from the endpoints where the agent is installed. To implement this search,
  you must ingest logs that contain the process GUID, process name, and parent process.
  Additionally, you must ingest complete command-line executions. These logs must
  be processed using the appropriate Splunk Technology Add-ons that are specific to
  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
  data model. Use the Splunk Common Information Model (CIM) to normalize the field
  names and speed up the data modeling process.
known_false_positives: Legitimate applications may spawn PowerShell as a child process
  of the the identified processes. Filter as needed.
references:
- https://attack.mitre.org/techniques/T1021/003/
- https://attack.mitre.org/techniques/T1021/006/
- https://attack.mitre.org/techniques/T1047/
- https://attack.mitre.org/techniques/T1053/005/
- https://attack.mitre.org/techniques/T1543/003/
tags:
  analytic_story:
  - Active Directory Lateral Movement
  - Malicious PowerShell
  - Hermetic Wiper
  - Data Destruction
  - Scheduled Tasks
  asset_type: Endpoint
  confidence: 50
  impact: 90
  message: A PowerShell process was spawned as a child process of typically abused
    processes on $dest$
  mitre_attack_id:
  - T1021
  - T1021.003
  - T1021.006
  - T1047
  - T1053.005
  - T1543.003
  - T1059.001
  - T1218.014
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.dest
  - Processes.user
  - Processes.parent_process_name
  - Processes.parent_process
  - Processes.original_file_name
  - Processes.process_name
  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 45
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog