mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
57 lines
3.4 KiB
YAML
57 lines
3.4 KiB
YAML
name: PowerShell Invoke CIMMethod CIMSession
|
|
id: 651ee958-a433-471c-b264-39725b788b83
|
|
version: 3
|
|
date: '2024-09-30'
|
|
author: Michael Haag, Splunk
|
|
type: Anomaly
|
|
status: production
|
|
data_source:
|
|
- Powershell Script Block Logging 4104
|
|
description: The following analytic detects the creation of a New-CIMSession cmdlet followed by the use of the Invoke-CIMMethod cmdlet within PowerShell. It leverages PowerShell Script Block Logging to identify these specific cmdlets in the ScriptBlockText field. This activity is significant because it mirrors the behavior of the Invoke-WMIMethod cmdlet, often used for remote code execution via NTLMv2 pass-the-hash authentication. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access and control over targeted systems.
|
|
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*invoke-CIMMethod*", "*New-CimSession*") | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_invoke_cimmethod_cimsession_filter`'
|
|
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
|
|
known_false_positives: False positives may be present based on third-party applications or administrators using CIM. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
|
|
references:
|
|
- https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/invoke-cimmethod?view=powershell-7.3
|
|
drilldown_searches:
|
|
- name: View the detection results for - "$Computer$"
|
|
search: '%original_detection_search% | search Computer = "$Computer$"'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
- name: View risk events for the last 7 days for - "$Computer$"
|
|
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
tags:
|
|
analytic_story:
|
|
- Malicious PowerShell
|
|
- Active Directory Lateral Movement
|
|
asset_type: Endpoint
|
|
confidence: 50
|
|
impact: 50
|
|
message: PowerShell was identified running a Invoke-CIMMethod Invoke-CIMSession on $Computer$.
|
|
mitre_attack_id:
|
|
- T1047
|
|
observable:
|
|
- name: Computer
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- EventCode
|
|
- ScriptBlockText
|
|
- Computer
|
|
risk_score: 25
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell.log
|
|
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
|
sourcetype: xmlwineventlog
|