- title: Suspicious PowerShell Parameter Substring
id: 36210e0d-5b19-485d-a087-c096088885f0
status: experimental
description: Detects suspicious PowerShell invocation with a parameter substring
references:
- http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
tags:
- attack.execution
- attack.t1086
author: Florian Roth (rule), Daniel Bohannon (idea), Roberto Rodriguez (Fix)
logsource:
category: process_creation
product: windows
service: null
detection:
selection:
Image:
- '*\Powershell.exe'
CommandLine:
- ' -windowstyle h '
- ' -windowstyl h'
- ' -windowsty h'
- ' -windowst h'
- ' -windows h'
- ' -windo h'
- ' -wind h'
- ' -win h'
- ' -wi h'
- ' -win h '
- ' -win hi '
- ' -win hid '
- ' -win hidd '
- ' -win hidde '
- ' -NoPr '
- ' -NoPro '
- ' -NoProf '
- ' -NoProfi '
- ' -NoProfil '
- ' -nonin '
- ' -nonint '
- ' -noninte '
- ' -noninter '
- ' -nonintera '
- ' -noninterac '
- ' -noninteract '
- ' -noninteracti '
- ' -noninteractiv '
- ' -ec '
- ' -encodedComman '
- ' -encodedComma '
- ' -encodedComm '
- ' -encodedCom '
- ' -encodedCo '
- ' -encodedC '
- ' -encoded '
- ' -encode '
- ' -encod '
- ' -enco '
- ' -en '
condition: selection
falsepositives:
- Penetration tests
level: high
In [ ]:
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd
In [ ]:
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-*', doc_type='doc')
In [ ]:
s = searchContext.query('query_string', query='(process_path.keyword:(*\\Powershell.exe) AND process_command_line:("\ \-windowstyle\ h\ " OR "\ \-windowstyl\ h" OR "\ \-windowsty\ h" OR "\ \-windowst\ h" OR "\ \-windows\ h" OR "\ \-windo\ h" OR "\ \-wind\ h" OR "\ \-win\ h" OR "\ \-wi\ h" OR "\ \-win\ h\ " OR "\ \-win\ hi\ " OR "\ \-win\ hid\ " OR "\ \-win\ hidd\ " OR "\ \-win\ hidde\ " OR "\ \-NoPr\ " OR "\ \-NoPro\ " OR "\ \-NoProf\ " OR "\ \-NoProfi\ " OR "\ \-NoProfil\ " OR "\ \-nonin\ " OR "\ \-nonint\ " OR "\ \-noninte\ " OR "\ \-noninter\ " OR "\ \-nonintera\ " OR "\ \-noninterac\ " OR "\ \-noninteract\ " OR "\ \-noninteracti\ " OR "\ \-noninteractiv\ " OR "\ \-ec\ " OR "\ \-encodedComman\ " OR "\ \-encodedComma\ " OR "\ \-encodedComm\ " OR "\ \-encodedCom\ " OR "\ \-encodedCo\ " OR "\ \-encodedC\ " OR "\ \-encoded\ " OR "\ \-encode\ " OR "\ \-encod\ " OR "\ \-enco\ " OR "\ \-en\ "))')
response = s.execute()
if response.success():
df = pd.DataFrame((d.to_dict() for d in s.scan()))
In [ ]:
df.head()