Florian Roth
28 lines
823 B
YAML
28 lines
823 B
YAML
title: Renamed Powershell.exe
|
|
status: experimental
|
|
description: Detects copying and renaming of powershell.exe before execution (RETEFE malware DOC/macro starting Sept 2018)
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1086/
|
|
- https://isc.sans.edu/forums/diary/Maldoc+Duplicating+PowerShell+Prior+to+Use/24254/
|
|
tags:
|
|
- attack.t1086
|
|
- attack.execution
|
|
author: Tom Ueltschi (@c_APT_ure)
|
|
logsource:
|
|
product: windows
|
|
service: sysmon
|
|
detection:
|
|
selection:
|
|
EventID: 1
|
|
Description: Windows PowerShell
|
|
exclusion_1:
|
|
Image:
|
|
- powershell.exe
|
|
- powershell_ise.exe
|
|
exclusion_2:
|
|
Description: Windows PowerShell ISE
|
|
condition: all of selection and not (1 of exclusion_*)
|
|
falsepositives:
|
|
- penetration tests, red teaming
|
|
level: high
|