/
proc_creation_win_powershell_non_interactive_execution.yml
42 lines (42 loc) · 1.96 KB
/
proc_creation_win_powershell_non_interactive_execution.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
title: Non Interactive PowerShell Process Spawned
id: f4bbd493-b796-416e-bbf2-121235348529
status: test
description: Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.
references:
- https://web.archive.org/web/20200925032237/https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190410151110.html
author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)
date: 2019/09/12
modified: 2023/09/07
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
filter_main_generic:
ParentImage|endswith:
- ':\Windows\explorer.exe'
- ':\Windows\System32\CompatTelRunner.exe'
- ':\Windows\SysWOW64\explorer.exe'
filter_main_windows_update:
ParentImage: ':\$WINDOWS.~BT\Sources\SetupHost.exe' # During Windows updates/upgrades
# CommandLine: powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
filter_optional_vscode:
# Triggered by VsCode when you open a Shell inside the workspace
ParentImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
ParentCommandLine|contains: ' --ms-enable-electron-run-as-node '
filter_optional_terminal:
ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal_'
ParentImage|endswith: '\WindowsTerminal.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Likely. Many admin scripts and tools leverage PowerShell in their BAT or VB scripts which may trigger this rule often. It is best to add additional filters or use this to hunt for anomalies
level: low