Powershell Execution

Hypothesis and description

PowerShell is a scripting environment included with Windows that is used by both attackers and administrators. Execution of PowerShell scripts in most Windows versions is opaque and not typically secured by antivirus which makes using PowerShell an easy way to circumvent security measures. This analytic detects execution of PowerShell scripts.

Powershell can be used to hide monitored command line execution such as:

- net use

- sc start

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2014-04-11
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1059 Command and Scripting InterpreterT1059.001	Execution	High
T1059 Command and Scripting InterpreterT1059.001	Stealth (formerly Defense Evasion)	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1059Command and Scripting Interpreter
.001 PowerShell

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

Look for versions of PowerShell that were not launched interactively.

process = search Process:Create
powershell = filter process where (exe == "powershell.exe" AND parent_exe != "explorer.exe" )
output powershell

SplunkData model: Sysmon native

Splunk version of the above pseudocode.

index=__your_sysmon_index__ EventCode=1 Image="C:\\Windows\\*\\powershell.exe" ParentImage!="C:\\Windows\\explorer.exe"|stats values(CommandLine) as "Command Lines" values(ParentImage) as "Parent Images" by ComputerName

EQLData model: EQL native

EQL version of the above pseudocode.

process where subtype.create and
  (process_name == "powershell.exe" and parent_process_name != "explorer.exe")

DNIFData model: Sysmon native

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=powershell.exe NOT $ParentProcess=regex(.*explorer.exe.*)i limit 30

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\powershell.exe" -parent_image="C:\Windows\explorer.exe"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

3 more in the full list

View CAR-2014-04-003 on car.mitre.org