name: Powershell Processing Stream Of Data
id: 0d718b52-c9f1-11eb-bc61-acde48001122
version: 2
date: '2023-04-14'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies suspicious PowerShell script execution
  via EventCode 4104 that is processing compressed stream data. This is typically
  found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files
  that are stream flattened and will be deflated durnig execution. During triage,
  review parallel processes within the same timeframe. Review the full script block
  to identify other related artifacts.
data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText
  = "*IO.StreamReader*" OR ScriptBlockText = "*]::Decompress*" | stats count min(_time)
  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell may used this function to process compressed data.
references:
- https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
tags:
  analytic_story:
  - Malicious PowerShell
  - AsyncRAT
  - Hermetic Wiper
  - Data Destruction
  - IcedID
  asset_type: Endpoint
  confidence: 80
  impact: 50
  message: A suspicious powershell script contains stream command in $ScriptBlockText$
    commonly for processing compressed or to decompressed binary file with EventCode
    $EventCode$ in host $Computer$
  mitre_attack_id:
  - T1059
  - T1059.001
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  - name: UserID
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - ScriptBlockText
  - Computer
  - UserID
  - Score
  risk_score: 40
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log
    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
    sourcetype: xmlwineventlog