Suspicious PowerShell Invocations - Specific - PowerShell Module

Severity: high
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro
Source: upstream

Detects suspicious PowerShell invocation command parameters

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Event coverage

Provider	Event ID	Title
PowerShell	4103	Payload Context: ContextInfo User Data: UserData.

Stages and Predicates

Stage 1: `1 of selection_convert_b64`

ContextInfo|contains: ' -c '
ContextInfo|contains: ' -w '
ContextInfo|contains: -nop
ContextInfo|contains: '[Convert]::FromBase64String'
ContextInfo|contains: hidden

Stage 2: `1 of selection_iex`

ContextInfo|contains: ' -c '
ContextInfo|contains: ' -w '
ContextInfo|contains: -noni
ContextInfo|contains: -nop
ContextInfo|contains: New-Object
ContextInfo|contains: hidden
ContextInfo|contains: iex

Stage 3: `1 of selection_enc`

ContextInfo|contains: ' -w '
ContextInfo|contains: -Enc
ContextInfo|contains: -ep
ContextInfo|contains: bypass
ContextInfo|contains: hidden

Stage 4: `1 of selection_reg`

or:
ContextInfo|contains: '\software\microsoft\windows\currentversion\policies\explorer\run'
ContextInfo|contains: '\software\microsoft\windows\currentversion\run'
ContextInfo|contains: '\software\wow6432node\microsoft\windows\currentversion\run'
ContextInfo|contains: add
ContextInfo|contains: powershell
ContextInfo|contains: reg

Stage 5: `1 of selection_webclient`

ContextInfo|contains: -noprofile
ContextInfo|contains: -windowstyle
ContextInfo|contains: .download
ContextInfo|contains: bypass
ContextInfo|contains: hidden
ContextInfo|contains: new-object
ContextInfo|contains: system.net.webclient

Stage 6: `1 of selection_iex_webclient`

ContextInfo|contains: .Download
ContextInfo|contains: Net.WebClient
ContextInfo|contains: New-Object
ContextInfo|contains: iex

Stage 7: `not 1 of filter_chocolatey`

or:
ContextInfo|contains: '(New-Object System.Net.WebClient).DownloadString(''https://community.chocolatey.org/install.ps1'
ContextInfo|contains: Write-ChocolateyWarning

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`ContextInfo`	match	`-c` `-w` `(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1` `-Enc` `-ep` `-noni` `-nop` `-noprofile` `-windowstyle` `.Download` `.download` `Net.WebClient` `New-Object` `Write-ChocolateyWarning` `[Convert]::FromBase64String` `\software\microsoft\windows\currentversion\policies\explorer\run` `\software\microsoft\windows\currentversion\run` `\software\wow6432node\microsoft\windows\currentversion\run` `add` `bypass` `hidden` `iex` `new-object` `powershell` `reg` `system.net.webclient`

Suspicious PowerShell Invocations - Specific - PowerShell Module

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: 1 of selection_convert_b64

Stage 2: 1 of selection_iex

Stage 3: 1 of selection_enc

Stage 4: 1 of selection_reg

Stage 5: 1 of selection_webclient

Stage 6: 1 of selection_iex_webclient

Stage 7: not 1 of filter_chocolatey