Anvilogic medium experimental spl
Suspicious PowerShell Parameter Substring [splunk-winevent]
Threat actors may use obfuscated and truncated PowerShell execution arguments to evade detection, leveraging PowerShell's parameter binding functionality that allows partial matching of command-line arguments. This use case detects process executions containing substrings for commonly abused PowerShell parameters.
Detection Logic
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688)
OR "EventID>4688<"
OR Type=Process) ("cmd.exe"
OR "pwsh.exe"
OR "powershell.exe") (" -windowstyl "
OR " -windowsty "
OR " -windowst "
OR " -windows "
OR " -windo "
OR " -wind "
OR " -win "
OR " -wi")
OR (" -executionpolic "
OR " -executionpoli "
OR " -executionpol "
OR " -executionpo "
OR " -executionp "
OR " -execution "
OR " -executio "
OR " -executi "
OR " -execut "
OR " -execu "
OR " -exec "
OR " -exe "
OR " -ex")
OR " -NoPr "
OR " -NoPro "
OR " -NoProf "
OR " -NoProfi "
OR " -NoProfil "
OR " -nonin "
OR " -nonint "
OR " -noninte "
OR " -noninter "
OR " -nonintera "
OR " -noninterac "
OR " -noninteract "
OR " -noninteracti "
OR " -noninteractiv "
OR " -ec "
OR " -encodedComman "
OR " -encodedComma "
OR " -encodedComm "
OR " -encodedCom "
OR " -encodedCo "
OR " -encodedC "
OR " -encoded "
OR " -encode "
OR " -encod "
OR " -enco "
OR " -en "
OR (" /windowstyle "
OR " /windowstyl "
OR " /windowsty "
OR " /windowst "
OR " /windows "
OR " /windo "
OR " /wind "
OR " /win "
OR " /wi")
OR (" /executionpolic "
OR " /executionpoli "
OR " /executionpol "
OR " /executionpo "
OR " /executionp "
OR " /execution "
OR " /executio "
OR " /executi "
OR " /execut "
OR " /execu "
OR " /exec "
OR " /exe "
OR " /ex")
OR " /NoPr "
OR " /NoPro "
OR " /NoProf "
OR " /NoProfi "
OR " /NoProfil "
OR " /nonin "
OR " /nonint "
OR " /noninte "
OR " /noninter "
OR " /nonintera "
OR " /noninterac "
OR " /noninteract "
OR " /noninteracti "
OR " /noninteractiv "
OR " /ec "
OR " /encodedComman "
OR " /encodedComma "
OR " /encodedComm "
OR " /encodedCom "
OR " /encodedCo "
OR " /encodedC "
OR " /encoded "
OR " /encode "
OR " /encod "
OR " /enco "
OR " /en"
| regex process="(?i)\s(-
| \/)(win?d?o?w?s?t?y?l?\s+hi?d?d?e?
| windowstyle\s+h\s
| NoPro?f?i?l?\s
| nonint?e?r?a?c?t?i?v?\s
| enc?o?d?e?d?C?o?m?m?a?n?\s
| ((exe?c?u?t?i?o?n?p?o?l?i?c?)
| ep)\s+(bypass)?
| ec\s)"
| table _time, host, user user, process, process_*, parent_*
| bin span=1s
| stats values(*) as * by _time, hostField Validations
Loading…
Comments (0)
Loading comments...