[TheLawsOfChaos]

Modified the 4104 event to utilize XML event format vs Classic.

Details

What does this PR have in it? Screenshots are worth 1000 words 😄

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
• CI/CD jobs passed ✔️
• Validated SPL logic.
• Validated tags, description, and how to implement.
• Verified references match analytic.

[patel-bhavin]

@TheLawsOfChaos : Hello, along with the search updates to use XML format we would also need the corresponding datasets in XML format for us to be able to test and merge these changes? Can you share the XML log file or the event which will trigger this search?
Thank you

[TheLawsOfChaos]

@patel-bhavin Here is a sample sanitized event:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-PowerShell" Guid="{a0c1853b-5c40-4b15-8766-3cf1c58f985a}"/>
    <EventID>4104</EventID>
    <Version>1</Version>
    <Level>5</Level>
    <Task>2</Task>
    <Opcode>15</Opcode>
    <Keywords>0x0</Keywords>
    <TimeCreated SystemTime="2022-09-12T20:05:41.6820566Z"/>
    <EventRecordID>140500</EventRecordID>
    <Correlation ActivityID="{781088bc-c26e-0002-2cda-15786ec2d801}"/>
    <Execution ProcessID="20492" ThreadID="19256"/>
    <Channel>Microsoft-Windows-PowerShell/Operational</Channel>
    <Computer></Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="MessageNumber">1</Data>
    <Data Name="MessageTotal">1</Data>
    <Data Name="ScriptBlockText"></Data>
    <Data Name="ScriptBlockId"></Data>
    <Data Name="Path"></Data>
  </EventData>
</Event>

Here is a good breakdown as well of possible fields : https://docs.logrhythm.com/docs/devices/ms-windows-event-log-sources/ms-windows-event-logging-xml-powershell/evid-4104-ps-script-execution

[patel-bhavin]

the above log event does not have the attack in it. we will need the actual attack data in XML format and run it via detection testing.

[TheLawsOfChaos]

The event is the same, it's merely changing the Event Log format from Classic Windows Log to XML Windows Logs. So you don't need a malicious event; you just need to update the field names, which is what the PR is for.

[patel-bhavin]

i have created a new dataset in XML format and added your search updates to this PR- #2366