detection.wiki

Detection rules › Sigma

HackTool - Evil-WinRm Execution - PowerShell Module

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.

Event coverage

ProviderEvent IDTitle
PowerShell4103Payload Context: ContextInfo User Data: UserData.

Stages and Predicates

Stage 1: selection_wsm

or:
ContextInfo|contains: ':\Windows\SysWOW64\wsmprovhost.exe'
ContextInfo|contains: ':\Windows\System32\wsmprovhost.exe'

Stage 2: 1 of selection_payload_1

or:
Payload|contains: Bypass-4MSI
Payload|contains: 'Donut-Loader -process_id*-donutfile'
Payload|contains: 'IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace(''???'','''')'
Payload|contains: 'Invoke-Binary '
Payload|contains: 'value="(get-item*).length'
Payload|contains: 'value="(get-location).path'

Stage 3: 1 of selection_payload_2

Payload|contains: '$servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\"'
Payload|contains: 'Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath'

Stage 4: 1 of selection_payload_3

Payload|contains: '$a +=  \"$($_.FullName.Replace(''\\'',''/''))/\"}else{  $a += \"$($_.FullName.Replace(''\\'', ''/''))\" }'
Payload|contains: '$a=@();$'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ContextInfomatch
  • :\Windows\SysWOW64\wsmprovhost.exe
  • :\Windows\System32\wsmprovhost.exe
Payloadmatch
  • $a += \"$($_.FullName.Replace('\\','/'))/\"}else{ $a += \"$($_.FullName.Replace('\\', '/'))\" }
  • $a=@();$
  • $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\"
  • Bypass-4MSI
  • Donut-Loader -process_id*-donutfile
  • IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','')
  • Invoke-Binary
  • Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath
  • value="(get-item*).length
  • value="(get-location).path