☰
Navigation :

Malicious Powershell Process - Multiple Suspicious Command-Line Arguments

Description

This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line.

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Advanced Threat Detection

Category

Endpoint Compromise

Alert Volume

This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line.

SPL Difficulty

None

Journey

Stage 3

MITRE ATT&CK Tactics

Defense Evasion

MITRE ATT&CK Techniques

Obfuscated Files or Information

Obfuscated Files or Information

MITRE Threat Groups

APT-C-36
APT18
APT19
APT28
APT29
APT3
APT32
APT33
APT37
APT41
BlackOasis
Blue Mockingbird
Chimera
Cobalt Group
Dark Caracal
Darkhotel
Dust Storm
Elderwood
FIN6
FIN7
FIN8
Frankenstein
Gallmaker
Gamaredon Group
Group5
Honeybee
Inception
Lazarus Group
Leafminer
Leviathan
Machete
Magic Hound
Mofang
Molerats
MuddyWater
Night Dragon
OilRig
Patchwork
Putter Panda
Rocke
Sandworm Team
Silence
Soft Cell
TA505
Threat Group-3390
Tropic Trooper
Turla
Whitefly
Wizard Spider
menuPass

Kill Chain Phases

Command and Control
Actions On Objectives

   Help

Malicious Powershell Process - Multiple Suspicious Command-Line Arguments Help

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

   Search

| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* AND process=*-NonI* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter`
Open in Search