Anvilogic low experimental spl

Potential Target Discovery via PowerShell Event Log Queries [splunk-powershell]

Threat actors may use custom scripts during discovery activities to identify targets on a network. This use case detects PowerShell scripts querying System, Security, and Windows Terminal Services event logs as observed with RagnarLocker. -- Threat Actor Association: APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM) - Software Association: RagnarLocker

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) 
OR "<EventID>4103<" TERM(EventCode=4104) 
OR "<EventID>4104<") (TERM(Get-EventLog) 
OR TERM(Get-WinEvent)) ("7001" 
OR "7002" 
OR "21" 
OR "25" 
OR "4624")
| table _time, host, user process, process_*, signature_id
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...