From 338d0b7dbceff894e0610d33f9783e44b6df4fc1 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Mon, 29 Aug 2022 12:35:05 -0400 Subject: [PATCH] Updated for XML format Updated query to utilize XML format of Windows logs instead of Classic. Replaced the following fields: - Message AS ScriptBlockText - ComputerName AS Computer - User AS UserID Fixed in both the query and the stats line. --- ..._instantiation_via_wmi_and_powershell_script_block.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index f9cb59a258..2915bc0bd6 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -9,10 +9,10 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote code execution. -search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*" - AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-WmiMethod*" AND ScriptBlockText="*-CN*" + AND ScriptBlockText="*-Class Win32_Process*" AND ScriptBlockText="*-Name create*") | stats count + min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer + UserID | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.