From bf98f4385096e8246a652f003aad25bbdfbed09e Mon Sep 17 00:00:00 2001
From: frack113 <magicfrancois@gmail.com>
Date: Tue, 1 Jun 2021 10:47:17 +0200
Subject: [PATCH] Set powershell_alternate_powershell_hosts.yml more accurate
 by adding the correct channel for EventID

---
 .../powershell_alternate_powershell_hosts.yml | 37 +++++++++++++------
 tools/config/winlogbeat-modules-enabled.yml   | 10 +++++
 tools/config/winlogbeat-old.yml               | 10 +++++
 tools/config/winlogbeat.yml                   | 10 +++++
 4 files changed, 55 insertions(+), 12 deletions(-)

diff --git a/rules/windows/powershell/powershell_alternate_powershell_hosts.yml b/rules/windows/powershell/powershell_alternate_powershell_hosts.yml
index acf3ed8b7..6346854c7 100644
--- a/rules/windows/powershell/powershell_alternate_powershell_hosts.yml
+++ b/rules/windows/powershell/powershell_alternate_powershell_hosts.yml
@@ -1,8 +1,10 @@
+action: global
 title: Alternate PowerShell Hosts
 id: 64e8e417-c19a-475a-8d19-98ea705394cc
 description: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
 status: experimental
 date: 2019/08/11
+modified: 2021/06/01
 author: Roberto Rodriguez @Cyb3rWard0g
 references:
     - https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190815181010.html
@@ -10,6 +12,20 @@ tags:
     - attack.execution
     - attack.t1059.001
     - attack.t1086  # an old one
+falsepositives:
+    - Programs using PowerShell directly without invocation of a dedicated interpreter
+    - MSP Detection Searcher
+    - Citrix ConfigSync.ps1
+level: medium   
+detection:
+    filter:
+        - ContextInfo: 'powershell.exe'
+        - Message: 'powershell.exe'
+        # Both fields contain key=value pairs where the key HostApplication is relevant but
+        # can't be referred directly as event field.
+    condition: selection and not filter
+ 
+---
 logsource:
     product: windows
     service: powershell
@@ -17,16 +33,13 @@ detection:
     selection:
         EventID:
             - 4103
-            - 400
         ContextInfo: '*'
-    filter:
-        - ContextInfo: 'powershell.exe'
-        - Message: 'powershell.exe'
-        # Both fields contain key=value pairs where the key HostApplication is relevant but
-        # can't be referred directly as event field.
-    condition: selection and not filter
-falsepositives:
-    - Programs using PowerShell directly without invocation of a dedicated interpreter
-    - MSP Detection Searcher
-    - Citrix ConfigSync.ps1
-level: medium
+---
+logsource:
+    product: windows
+    service: powershell-classic
+detection:
+    selection:
+        EventID:
+            - 400
+        ContextInfo: '*'
\ No newline at end of file
diff --git a/tools/config/winlogbeat-modules-enabled.yml b/tools/config/winlogbeat-modules-enabled.yml
index 8a70f2171..25debf7d8 100644
--- a/tools/config/winlogbeat-modules-enabled.yml
+++ b/tools/config/winlogbeat-modules-enabled.yml
@@ -35,6 +35,16 @@ logsources:
     service: sysmon
     conditions:
       winlog.channel: 'Microsoft-Windows-Sysmon/Operational'
+  windows-powershell:
+    product: windows
+    service: powershell
+    conditions:
+      winlog.channel: 'Microsoft-Windows-PowerShell/Operational'
+  windows-classicpowershell:
+    product: windows
+    service: powershell-classic
+    conditions:
+      winlog.channel: 'Windows PowerShell'
   windows-dns-server:
     product: windows
     service: dns-server
diff --git a/tools/config/winlogbeat-old.yml b/tools/config/winlogbeat-old.yml
index d942752a6..be68b3193 100644
--- a/tools/config/winlogbeat-old.yml
+++ b/tools/config/winlogbeat-old.yml
@@ -34,6 +34,16 @@ logsources:
     service: sysmon
     conditions:
       log_name: 'Microsoft-Windows-Sysmon/Operational'
+  windows-powershell:
+    product: windows
+    service: powershell
+    conditions:
+      winlog.channel: 'Microsoft-Windows-PowerShell/Operational'
+  windows-classicpowershell:
+    product: windows
+    service: powershell-classic
+    conditions:
+      winlog.channel: 'Windows PowerShell'
   windows-dns-server:
     product: windows
     service: dns-server
diff --git a/tools/config/winlogbeat.yml b/tools/config/winlogbeat.yml
index 38f19bce0..679ebed8c 100644
--- a/tools/config/winlogbeat.yml
+++ b/tools/config/winlogbeat.yml
@@ -34,6 +34,16 @@ logsources:
     service: sysmon
     conditions:
       winlog.channel: 'Microsoft-Windows-Sysmon/Operational'
+  windows-powershell:
+    product: windows
+    service: powershell
+    conditions:
+      winlog.channel: 'Microsoft-Windows-PowerShell/Operational'
+  windows-classicpowershell:
+    product: windows
+    service: powershell-classic
+    conditions:
+      winlog.channel: 'Windows PowerShell'
   windows-dns-server:
     product: windows
     service: dns-server