mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
92 lines
4.2 KiB
JSON
92 lines
4.2 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, user, process_name",
|
|
"rule_description": "The system $dest$ executed a PowerShell process with parameters to bypass the local execution policy.",
|
|
"rule_title": "PowerShell process with -executionpolicy bypass detected on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 50
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, process_name",
|
|
"suppress_period": "14400s"
|
|
}
|
|
},
|
|
"creation_date": "2018-03-19",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search looks for PowerShell processes that were launched using a parameter designed to bypass the local PowerShell execution policy. By default, the policy is set to \"Restricted,\" which disables the execution of PowerShell scripts. In environments that make heavy use of PowerShell, the policy can be set to allow only scripts signed by a trusted publisher. Malicious PowerShell use almost always includes the parameter <code>-ExecutionPolicy bypass</code>. PowerShell is very liberal when it comes to interpreting command-line parameters passed to it. For example, the parameter we look for, <code>-ExecutionPolicy</code>, can be abbreviated to <code>-Execution</code>, <code>-Exec</code>, or even <code>-ex</code>. As such, we look for <code>* -ex*</code>, which should catch all variations of this parameter, followed by the keyword <code>bypass</code>. This search will return the host, the user the process ran under, the process and its command-line arguments, the number of times it has seen this process, and the first and last times it saw this process.",
|
|
"how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
|
|
"known_false_positives": "There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 7",
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Command and Control",
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"PowerShell",
|
|
"Scripting"
|
|
],
|
|
"nist": [
|
|
"PR.PT",
|
|
"DE.CM",
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2018-12-03",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "50 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`| `ctime(lastTime)`| search process=* -ex* OR process=* bypass *",
|
|
"search_description": "This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell execution policy.",
|
|
"search_id": "9be56c82-b1cc-4318-87eb-d138afaaca39",
|
|
"search_name": "Malicious PowerShell Process - Execution Policy Bypass",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "3.0"
|
|
}
|