detection.wiki

Detection rules › Splunk

Malicious PowerShell Process With Obfuscation Techniques

Author
David Dorsey, Splunk
Source
upstream

The following analytic detects PowerShell processes launched with command-line arguments indicative of obfuscation techniques. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and complete command-line executions. This activity is significant because obfuscated PowerShell commands are often used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, or persistent access within the environment, posing a significant security risk.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: tstats

tstats WHERE (Processes.original_file_name="PowerShell.EXE" OR Processes.original_file_name="powershell_ise.EXE" OR Processes.original_file_name="pwsh.dll" OR Processes.process_name="powershell.exe" OR Processes.process_name="powershell_ise.exe" OR Processes.process_name="pwsh.exe") BY Processes.action, Processes.dest, Processes.original_file_name, Processes.parent_process, Processes.parent_process_exec, Processes.parent_process_guid, Processes.parent_process_id, Processes.parent_process_name, Processes.parent_process_path, Processes.process, Processes.process_exec, Processes.process_guid, Processes.process_hash, Processes.process_id, Processes.process_integrity_level, Processes.process_name, Processes.process_path, Processes.user, Processes.user_id, Processes.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: eval

eval ... using (process)

Stage 6: search

search num_obfuscation>10

Stage 7: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Processes.original_file_nameeq
  • PowerShell.EXE corpus 64 (sigma 60, splunk 4)
  • powershell_ise.EXE corpus 8 (sigma 4, splunk 4)
  • pwsh.dll corpus 72 (sigma 68, splunk 4)
Processes.process_nameeq
  • powershell.exe corpus 3 (splunk 3)
  • powershell_ise.exe corpus 3 (splunk 3)
  • pwsh.exe corpus 3 (splunk 3)
num_obfuscationgt
  • 10