Rule: PowerShell script run in AppData folders

2019-01-12 12:03:30 +01:00
parent 604d88cf1e
commit 9a6b3b5389
1 changed files with 39 additions and 0 deletions
@@ -0,0 +1,39 @@
+---
+action: global
+title: PowerShell Script Run in AppData
+status: experimental
+description: Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder 
+references:
+    - https://twitter.com/JohnLaTwC/status/1082851155481288706
+    - https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03
+author: Florian Roth
+date: 2019/01/09
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    condition: selection
+falsepositives:
+    - Administrative scripts
+level: medium
+---
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection:
+        EventID: 1
+        CommandLine: 
+            - '* /c powershell*\AppData\Local\*'
+            - '* /c powershell*\AppData\Roaming\*'
+---
+logsource:
+    product: windows
+    service: security
+    definition: 'Requirements: Audit Policy : Detailed Tracking > Audit Process creation, Group Policy : Administrative Templates\System\Audit Process Creation'
+detection:
+    selection:
+        EventID: 4688
+        ProcessCommandLine: 
+            - '* /c powershell*\AppData\Local\*'
+            - '* /c powershell*\AppData\Roaming\*'