Jonhnathan
49854aaae2
* Add Investigation Guide and config to Suspicious Portable Executable Encoded in Powershell Script * Add Investigation Guide and config to "PowerShell Suspicious Discovery Related Windows API Functions" rule * Add Investigation Guide and Config to "PowerShell MiniDump Script" rule * Add logging policy reference * Add Investigation Guide/Config to "PowerShell Suspicious Script with Audio Capture Capabilities" * Add Related Rules GUIDs * Add Investigation Guide/config for "Potential Process Injection via PowerShell" * Adjust Response and remediation * Add Investigation Guide/config for "PowerShell Keylogging Script" * bump updated_date * Apply suggestions from Samir Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Apply suggestions * Revise line from investigation guides Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
142 lines
4.2 KiB
TOML
142 lines
4.2 KiB
TOML
[metadata]
|
|
creation_date = "2021/10/13"
|
|
maturity = "production"
|
|
updated_date = "2021/11/30"
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
description = """
|
|
This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these
|
|
functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain
|
|
trusts, groups, etc.
|
|
"""
|
|
false_positives = ["Legitimate Powershell Scripts that make use of these Functions"]
|
|
from = "now-9m"
|
|
index = ["winlogbeat-*", "logs-windows.*"]
|
|
language = "kuery"
|
|
license = "Elastic License v2"
|
|
name = "PowerShell Suspicious Discovery Related Windows API Functions"
|
|
note = """## Triage and analysis.
|
|
|
|
### Investigating PowerShell Suspicious Discovery Related Windows API Functions
|
|
|
|
PowerShell is one of the main tools used by system administrators for automation, report routines, and other tasks.
|
|
|
|
Attackers can use PowerShell to interact with the Win32 API to bypass file based AntiVirus detections, using libraries
|
|
like PSReflect or Get-ProcAddress Cmdlet.
|
|
|
|
#### Possible investigation steps:
|
|
|
|
- Examine script content that triggered the detection.
|
|
- Investigate script execution chain (parent process tree).
|
|
- Inspect any file or network events from the suspicious powershell host process instance.
|
|
- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.
|
|
|
|
### False Positive Analysis
|
|
|
|
- Verify whether the script content is malicious/harmful.
|
|
|
|
### Related Rules
|
|
|
|
- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
|
|
|
|
### Response and Remediation
|
|
|
|
- Immediate response should be taken to validate, investigate, and potentially contain the activity to prevent further
|
|
post-compromise behavior.
|
|
|
|
## Config
|
|
|
|
The 'PowerShell Script Block Logging' logging policy must be enabled.
|
|
Steps to implement the logging policy with with Advanced Audit Configuration:
|
|
|
|
```
|
|
Computer Configuration >
|
|
Administrative Templates >
|
|
Windows PowerShell >
|
|
Turn on PowerShell Script Block Logging (Enable)
|
|
```
|
|
|
|
Steps to implement the logging policy via registry:
|
|
|
|
```
|
|
reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
|
|
```
|
|
"""
|
|
references = [
|
|
"https://github.com/BC-SECURITY/Empire/blob/9259e5106986847d2bb770c4289c0c0f1adf2344/data/module_source/situational_awareness/network/powerview.ps1#L21413",
|
|
"https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md"
|
|
]
|
|
risk_score = 47
|
|
rule_id = "61ac3638-40a3-44b2-855a-985636ca985e"
|
|
severity = "medium"
|
|
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Discovery"]
|
|
timestamp_override = "event.ingested"
|
|
type = "query"
|
|
|
|
query = '''
|
|
event.category:process and
|
|
powershell.file.script_block_text : (
|
|
NetShareEnum or
|
|
NetWkstaUserEnum or
|
|
NetSessionEnum or
|
|
NetLocalGroupEnum or
|
|
NetLocalGroupGetMembers or
|
|
DsGetSiteName or
|
|
DsEnumerateDomainTrusts or
|
|
WTSEnumerateSessionsEx or
|
|
WTSQuerySessionInformation or
|
|
LsaGetLogonSessionData or
|
|
QueryServiceObjectSecurity
|
|
)
|
|
'''
|
|
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1135"
|
|
name = "Network Share Discovery"
|
|
reference = "https://attack.mitre.org/techniques/T1135/"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1069"
|
|
name = "Permission Groups Discovery"
|
|
reference = "https://attack.mitre.org/techniques/T1069/"
|
|
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1069.001"
|
|
name = "Local Groups"
|
|
reference = "https://attack.mitre.org/techniques/T1069/001/"
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0007"
|
|
name = "Discovery"
|
|
reference = "https://attack.mitre.org/tactics/TA0007/"
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[rule.threat.technique]]
|
|
id = "T1059"
|
|
name = "Command and Scripting Interpreter"
|
|
reference = "https://attack.mitre.org/techniques/T1059/"
|
|
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1059.001"
|
|
name = "PowerShell"
|
|
reference = "https://attack.mitre.org/techniques/T1059/001/"
|
|
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1106"
|
|
name = "Native API"
|
|
reference = "https://attack.mitre.org/techniques/T1106/"
|
|
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|