detect_certify_with_powershell_script_block_logging.yml

name: Detect Certify With PowerShell Script Block Logging
id: f533ca6c-9440-4686-80cb-7f294c07812a
version: 1
date: '2023-06-25'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when the attacker tool  Certify is used through an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. The default command line arguments for the binary version of this tools are similar to PowerShell calls and perform near identical enumeration or exploitation functions.
data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 (ScriptBlockText IN ("*find *") AND ScriptBlockText IN ("* /vulnerable*","* -vulnerable*","* /enrolleeSuppliesSubject *","* /json /outfile*")) OR (ScriptBlockText IN (,"*auth *","*req *",) AND ScriptBlockText IN ("* -ca *","* -username *","* -u *")) OR (ScriptBlockText IN ("*request *","*download *") AND ScriptBlockText IN ("* /ca:*"))
| stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command Values(OpCode) as reason values(Path) as file_name values(UserID) as user by _time Computer EventCode 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| eval file_name = case(isnotnull(file_name),file_name,true(),"unknown")
| eval signature = substr(command,0,256)
| rename Computer as dest,EventCode as signature_id
| `detect_certify_with_powershell_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell..
known_false_positives: Unknown, partial script block matches.  
references:
- https://github.com/GhostPack/Certify
- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
tags:
  analytic_story:
  - Windows Certificate Services
  - Malicious PowerShell
  asset_type: Endpoint
  confidence: 90
  impact: 100
  message: Certify arguments through PowerShell detected on $dest$.
  mitre_attack_id:
  - T1649
  - T1059
  - T1059.001
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: user
    type: User
    role:
    - Victim
  - name: command
    type: Process
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - ScriptBlockText
  - OpCode
  - Path
  - user
  - Computer 
  - EventCode
  risk_score: 90
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell.log
    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
    sourcetype: xmlwineventlog
    update_timestamp: true