Elastic Defend high stable eql

PowerShell Empire Script Execution

Identifies the execution of PowerShell scripts with keywords from known open source Empire penetration testing tool.

View Source

Detection Logic

api where process.Ext.api.name == "AmsiScanBuffer" and
 (process.name in~ ("powershell.exe") or process.Ext.api.parameters.app_name == "PowerShell") and
  process.Ext.api.parameters.buffer :
               ("*%256*%256*-bxor*%256*",
                "*$data ($IV+$K)*
| IEX*",
                "*:CurrentListenerName*:ControlServers*",
                "*/admin/get.php,/news.php,/login/process.php*",
                "*/login/process.php*",
                "If($GPF)*")

Field Validations

Loading…

Comments (0)

Loading comments...