Techniques
Sample rules
Possible Lateral Movement PowerShell Spawn
- source: splunk
- technicques:
- T1021.003
- T1021.006
- T1047
- T1053.005
- T1059.001
- T1218.014
- T1543.003
Description
The following analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names, as well as command-line executions. This activity is significant as it could indicates lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
from datamodel=Endpoint.Processes where
(
Processes.parent_process_name IN (
"mmc.exe",
"services.exe",
"wmiprvse.exe",
"wsmprovhost.exe"
)
OR
(
Processes.parent_process_name="svchost.exe"
```
We exclude the "Schedule" service from the svchost.exe process. But since there are instances where its not hosted in a dedicated svchost process, we need to the hosting group "netsvcs" too
```
NOT Processes.parent_process IN (
"*-k netsvcs*",
"*-s Schedule*",
)
)
)
AND
(
Processes.process_name IN ("powershell.exe", "pwsh.exe")
OR
(
Processes.process_name=cmd.exe
Processes.process IN (
"*powershell*",
"*pwsh*"
)
)
)
NOT Processes.process IN ("*C:\\Windows\\CCM\\*")
by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user
Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `possible_lateral_movement_powershell_spawn_filter`