name: Powershell Processing Stream Of Data
id: 0d718b52-c9f1-11eb-bc61-acde48001122
version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
  via EventCode 4104 that is processing compressed stream data. This is typically
  found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files
  that are stream flattened and will be deflated durnig execution. During triage,
  review parallel processes within the same timeframe. Review the full script block
  to identify other related artifacts.
search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
  OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell may used this function to process compressed data.
references:
- https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
  analytic_story:
  - Malicious PowerShell
  automated_detection_testing: passed
  confidence: 80
  context:
  - source:endpoint
  - stage: Defense Evasion
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
  impact: 50
  kill_chain_phases:
  - Exploitation
  message: A suspicious powershell script contains stream command in $Message$ commonly
    for processing compressed or to decompressed binary file with EventCode $EventCode$
    in host $ComputerName$
  mitre_attack_id:
  - T1059.001
  observable:
  - name: ComputerName
    type: Hostname
    role:
    - Victim
  - name: User
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - Message
  - ComputerName
  - User
  - Score
  risk_score: 40
  security_domain: endpoint