rules/windows/create_remote_thread/sysmon_powershell_code_injection.yml

title: Accessing WinAPI in PowerShell. Code Injection.
id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50
status: experimental
description: Detecting Code injection with PowerShell in another process
author: Nikita Nazarov, oscd.community
date: 2020/10/06
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: create_remote_thread
    definition: 'Note that you have to configure logging for CreateRemoteThread in Symson config'
detection:
    selection:
        SourceImage|endswith: '\powershell.exe'
    condition: selection
falsepositives:
    - Unknown
level: high
Detecting Code injection with PowerShell in another process 2020-10-06 20:52:18 +03:00			`title: Accessing WinAPI in PowerShell. Code Injection.`
			`id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50`
			`status: experimental`
			`description: Detecting Code injection with PowerShell in another process`
Update powershell_code_injection.yml 2020-10-07 14:50:00 +03:00			`author: Nikita Nazarov, oscd.community`
Detecting Code injection with PowerShell in another process 2020-10-06 20:52:18 +03:00			`date: 2020/10/06`
			`references:`
			`- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse`
			`tags:`
			`- attack.execution`
			`- attack.t1059.001`
			`logsource:`
			`product: windows`
Clean-up service: sysmon as it will be replaced by filling the category 2021-04-15 02:02:25 +02:00			`category: create_remote_thread`
Detecting Code injection with PowerShell in another process 2020-10-06 20:52:18 +03:00			`definition: 'Note that you have to configure logging for CreateRemoteThread in Symson config'`
			`detection:`
			`selection:`
Update powershell_code_injection.yml 2020-10-07 14:50:00 +03:00			`SourceImage\|endswith: '\powershell.exe'`
Detecting Code injection with PowerShell in another process 2020-10-06 20:52:18 +03:00			`condition: selection`
			`falsepositives:`
			`- Unknown`
			`level: high`