Detectionmediumtest

Security Software Discovery Via Powershell Script

Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes. Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François Hubaut, Anish Bogati, Nasreddine Bencherchali (Nextron Systems)Created Thu Dec 16Updated Tue Oct 24904e8e61-8edf-4350-b59c-b905fc8e810cwindows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic
Detection Logic3 selectors
detection:
    selection_cmdlet:
        ScriptBlockText|contains:
            - 'get-process | \?'
            - 'get-process | where'
            - 'gps | \?'
            - 'gps | where'
    selection_field:
        ScriptBlockText|contains:
            - 'Company -like'
            - 'Description -like'
            - 'Name -like'
            - 'Path -like'
            - 'Product -like'
    selection_keywords:
        ScriptBlockText|contains:
            # Note: These strings are using wildcard assuming the search is using the "-like" operator.
            #       You can add specific variant with the actual process names to increase coverage
            - '\*avira\*'
            - '\*carbonblack\*'
            - '\*cylance\*'
            - '\*defender\*'
            - '\*kaspersky\*'
            - '\*malware\*'
            - '\*sentinel\*'
            - '\*symantec\*'
            - '\*virus\*'
    condition: all of selection_*
False Positives

False positives might occur due to the nature of the ScriptBlock being ingested as a big blob. Initial tuning is required.

As the "selection_cmdlet" is common in scripts the matching engine might slow down the search. Change into regex or a more accurate string to avoid heavy resource consumption if experienced

Rule Metadata
Rule ID
904e8e61-8edf-4350-b59c-b905fc8e810c
Status
test
Level
medium
Type
Detection
Created
Thu Dec 16
Modified
Tue Oct 24
Path
rules/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml
Raw Tags
attack.discoveryattack.t1518.001
View on GitHub