order powershell_script

2021-10-09 10:30:36 +02:00
parent 77749510b7
commit 5c68c42058
39 changed files with 2 additions and 1 deletions
@@ -0,0 +1,27 @@
+title: Execution via CL_Mutexverifiers.ps1
+id: 39776c99-1c7b-4ba0-b5aa-641525eee1a4
+description: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module
+status: experimental
+author: oscd.community, Natalia Shornikova
+date: 2020/10/14
+modified: 2021/05/21
+references:
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/CL_mutexverifiers.yml
+    - https://twitter.com/pabraeken/status/995111125447577600
+tags:
+    - attack.defense_evasion
+    - attack.t1216
+logsource:
+    product: windows
+    service: powershell
+    definition: Script block logging must be enabled
+detection:
+    selection:
+        EventID: 4104
+        ScriptBlockText|contains|all:
+          - 'CL_Mutexverifiers.ps1'
+          - 'runAfterCancelProcess'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high