Elastic Defend high stable eql

Potential Reverse Shell via Powershell

Identifies the execution of a PowerShell script that may allow remote commands execution via TCP, UDP or ICMP reverse shell.

View Source

Detection Logic

api where process.Ext.api.name == "AmsiScanBuffer" and
 (process.name in~ ("powershell.exe") or process.Ext.api.parameters.app_name == "PowerShell") and
  process.Ext.api.parameters.buffer : ("*Sockets.TCPClient(*", "*Sockets.UDPClient(*", "*Net.NetworkInformation.Ping*") and
  process.Ext.api.parameters.buffer : ("*while(*", "*while (*") and process.Ext.api.parameters.buffer : ("*.GetStream()*", "*.GetBytes(*") and
  process.Ext.api.parameters.buffer : ("*.Read(*", "*.Receive(*", "*.GetString(*") and process.Ext.api.parameters.buffer : ("*.Write(*", "*.Send(*")

Field Validations

Loading…

Comments (0)

Loading comments...