order powershell_script

2021-10-09 10:30:36 +02:00
parent 77749510b7
commit 5c68c42058
39 changed files with 2 additions and 1 deletions
@@ -0,0 +1,28 @@
+title: Data Compressed - PowerShell
+id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a
+status: experimental
+description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
+author: Timur Zinniatullin, oscd.community
+date: 2019/10/21
+modified: 2021/07/06
+references:
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560/T1560.md
+logsource:
+    product: windows
+    service: powershell
+    definition: Script block logging must be enabled
+detection:
+    selection:
+        EventID: 4104
+        ScriptBlockText|contains|all:
+            - '-Recurse'
+            - '|'
+            - 'Compress-Archive'
+    condition: selection
+falsepositives:
+    - Highly likely if archive operations are done via PowerShell.
+level: low
+tags:
+    - attack.exfiltration
+    - attack.t1560
+    - attack.t1002  # an old one