SlideShare a Scribd company logo

Detecting modern PowerShell attacks with SIEM

•Download as PPTX, PDF•
•
J
Justin Henderson

Automating with PowerShell - a favorite amongst security teams and hackers alike. Many modern attacks leverage PowerShell to evade antivirus, whitelisting, and other security products and technology. This presentation will share ways a SIEM can detect modern PowerShell attacks. Techniques discussed include quick wins and more detailed practices, addressing false positives and high volumes of PowerShell logs. Take a deeper dive into PowerShell monitoring and advanced endpoint analytics with SANS Instructors Justin Henderson and Tim Garcia.

Technology
1 of 27
SEC555 Detecting Modern PowerShell Attacks with SIEM Justin Henderson (GSE # 108) and Tim Garcia (SANS Certified Instructor) @SecurityMapper Presentation based on SEC555: SIEM with Tactical Analytics
SEC555 | SIEM with Tactical Analytics 2 About Us Justin Henderson • Author of SEC555: SIEM with Tactical Analytics • GIAC GSE # 108, Cyber Guardian Blue and Red • 58 industry certifications (need to get a new hobby) Tim Garcia • Information Security Engineer • SANS Certified Instructor Cyber Defense curriculum (SEC 301, 401, 501, 511, and 555)
SEC555 | SIEM with Tactical Analytics 3 Welcome! A copy of this talk is available at: https://github.com/SMAPPER/presentations More free stuff: https://github.com/HASecuritySolutions Special Thanks: Thank you to Lee Holmes and the Microsoft PowerShell team for their research and pure awesomeness!
SEC555 | SIEM with Tactical Analytics 4 PowerShell Awesomeness PowerShell is one of the BEST things that ever happened • For both defense and offense • It is an equal opportunity employer Defenders • Automate everything (firewalls, IDS, etc.) • Administration, Auditing, Hunt teaming, and much more Attackers • Completely own you and bypass controls
SEC555 | SIEM with Tactical Analytics 5 PowerShell = Attacker's Choice Award Attackers/malware love PowerShell, but why? • On lots of systems with multiple versions • Almost always enabled and allowed • Whitelisting - Allowed • Antivirus - Allowed • NextGen whatever / EDR - Allowed • Can be enabled remotely even if currently disabled • Lots of pre-built attacks available using PowerShell
SEC555 | SIEM with Tactical Analytics 6 Sample of PowerShell Evilness Common attack tools and frameworks available: • PowerSploit - Collection of evil modules and goodies • PowerShell Empire - Post-exploitation agent framework • Nishang - Useful all around pentesting framework • Invoke-Mimikatz - Memory based version of Mimikatz Attack Devices • Rubber Ducky - Keyboard emulation • Bash Bunny - Pure evilness with a cute bunny
SEC555 | SIEM with Tactical Analytics 7 Disabling PowerShell If PowerShell is so evil why not just disable it? • You need it… You really, truly need it • Automation is key tool in a defenders toolbelt • The good can/should outweigh the bad In a world without PowerShell… • Attackers would simply pick a different attack vector • Your defense capabilities would be weak
SEC555 | SIEM with Tactical Analytics 8 PowerShell Prevention Talk is primarily around detection rather than prevention • Specifically using logs and a SIEM (super powerful) Worth mentioning some PowerShell security mechanisms • ExecutionPolicy - Not really a security feature • Just Enough Administration (JEA) - Controls who can do what with PowerShell • Constrained Language Mode - Limits certain functionality often used by malware (non-core features)
SEC555 | SIEM with Tactical Analytics 9 Catching PowerShell Evil Ideally you want to catch PowerShell attacks… at scale • For this we need SIEM + log sources Key PowerShell data sources • Module logging • Script Block logging • Transcription logging • Process creation events • Sysinternals Sysmon logs PowerShell specific Command line logging
SEC555 | SIEM with Tactical Analytics 10 Module Logging Enables Event ID 4103 • Records module use • And parameters • Very verbose…
SEC555 | SIEM with Tactical Analytics 11 Module Logging Example Invoke-Mimikatz.ps1 ran on Windows 7 box with PS v5.1 • 8,555 events logged from running script once • Includes functions and parameters called • Logs based on every time a module is used
SEC555 | SIEM with Tactical Analytics 12 Script Block Logging PowerShell v5 added Script Block Logging (Event ID 4104) • Records blocks as they are executed • If too large spans multiple events • Data is decoded in log • Event type of WARNING used to log suspicious commands • WARNING events enabled by default • Can log start/stop times (4105, 4106)
SEC555 | SIEM with Tactical Analytics 13 Script Block Logging Example Invoke-Mimikatz.ps1 on same system = 509 events • Volume is a bit more easy to handle • But still a lot of data Includes what is executed only • Does not log output
SEC555 | SIEM with Tactical Analytics 14 Transcription Logging Also introduced in v5 was transcription logging • Contains both input and output • Saves to a file Default: “My DocumentsyyyyMMdd” • Location can be changed to centralized location
SEC555 | SIEM with Tactical Analytics 15 Transcription Example
SEC555 | SIEM with Tactical Analytics 16 Endpoint Logging Today, client-side attacks are more common • Means the attack occurs at the desktop • Which means you need desktop logs… Yet, cost of desktop logs is considered too high • If strategy is collect everything, that is true • If strategy is to stay nimble and tactical, it is more expensive not to log… Advanced agent filtering is helpful or file server tricks
SEC555 | SIEM with Tactical Analytics 17 PowerShell Command Line (Event ID: 4688) PowerShell is now commonly used for modern attacks
SEC555 | SIEM with Tactical Analytics 18 Command Line Adversaries like to bypass script files due to AV detection • Thus long, obfuscated commands are common • Or calls to download and execute code are made • Another example of their strength = their weakness Key augmentations for discovery: • Command line length (> 500 is odd) • Base64 discovery • Execution of downloaded code
SEC555 | SIEM with Tactical Analytics 19 Command Line Length
SEC555 | SIEM with Tactical Analytics 20 Base64 Encoding Common to see base64 encoded PowerShell attacks • Can be extracted using regex and then decoded Example: (?<base64_code>[A-Za-z0-9+/]{50,}[=]{0,2})
SEC555 | SIEM with Tactical Analytics 21 Download and Execute Code can be downloaded and run to minimize length • Also works with base64 encoding Invoke-Expression (iex) runs commands passed to it • Net.WebClient acts as a PowerShell web browser
SEC555 | SIEM with Tactical Analytics 22 PowerShell Downgrade Attacks PowerShell v5 awesome security features • Bad guys do not like v5 • But v5 systems have v2 - v5 Downgrade attacks bypass security • Except Event ID 400 gives it away • Look for EngineVersion less than 5
SEC555 | SIEM with Tactical Analytics 23 PowerShell Command Monitoring JEA requires modifications and process changes • Alternative solution is to parse and monitor commands from module logging Group regex match can extract all commands to an array Parses into
SEC555 | SIEM with Tactical Analytics 24 PowerShell Whitelist Detection Alternative method can be used to export all cmdlets • Export from trusted systems • Use as whitelist of cmdlets • Then alert on anything new Can be expanded to include • Parameters • Users • Systems
SEC555 | SIEM with Tactical Analytics 25 PowerShell Without PowerShell PowerShell does not equal PowerShell.exe • It can be loaded using DLLs System.Management.Automation.Dll System.Management.Automation.ni.Dll System.Reflection.Dll Catching requires monitoring DLL load events • Such as with Sysmon Event ID 7 or commercial software
SEC555 | SIEM with Tactical Analytics 26 Sysmon PowerShell Example
SEC555 | SIEM with Tactical Analytics 27 Summary PowerShell is awesome yet scary • Learn it, know about it, and detect unauthorized use Simple detects can find a lot • Look for long command line lengths • Look for encoding • Check cmdlets against whitelist == Totally awesome • Look for downgrade attempts • Look for PowerShell use outside powershell.exe

Recommended

A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
Sergey Soldatov
 
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
Michael Gough
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is on
Justin Henderson
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
Teymur Kheirkhabarov
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERA
Erik Van Buggenhout
 

Recommended

A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
Sergey Soldatov
 
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
Michael Gough
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is on
Justin Henderson
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
Teymur Kheirkhabarov
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERA
Erik Van Buggenhout
 
PowerShell for Penetration Testers
PowerShell for Penetration TestersPowerShell for Penetration Testers
PowerShell for Penetration Testers
Nikhil Mittal
 
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does ItAMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
Nikhil Mittal
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
0wn-premises: Bypassing Microsoft Defender for Identity
0wn-premises: Bypassing Microsoft Defender for Identity0wn-premises: Bypassing Microsoft Defender for Identity
0wn-premises: Bypassing Microsoft Defender for Identity
Nikhil Mittal
 
Understanding Windows Access Token Manipulation
Understanding Windows Access Token ManipulationUnderstanding Windows Access Token Manipulation
Understanding Windows Access Token Manipulation
Justin Bui
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeam
Dan Vasile
 
Breach and attack simulation tools
Breach and attack simulation toolsBreach and attack simulation tools
Breach and attack simulation tools
Bangladesh Network Operators Group
 
The Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query LanguageThe Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query Language
Ross Wolf
 
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton ChuvakinFive Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Anton Chuvakin
 
OSSIM Overview
OSSIM OverviewOSSIM Overview
OSSIM Overview
n|u - The Open Security Community
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE - ATT&CKcon
 
Lateral Movement with PowerShell
Lateral Movement with PowerShellLateral Movement with PowerShell
Lateral Movement with PowerShell
kieranjacobsen
 
PowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple Teaming
Nikhil Mittal
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
Matthew Dunwoody
 
Red Team Methodology - A Naked Look
Red Team Methodology - A Naked LookRed Team Methodology - A Naked Look
Red Team Methodology - A Naked Look
Jason Lang
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
Ross Wolf
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
Jorge Orchilles
 
Standard logs made into actionable detects
Standard logs made into actionable detectsStandard logs made into actionable detects
Standard logs made into actionable detects
Justin Henderson
 
GCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection AnalystGCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection Analyst
Justin Henderson
 

More Related Content

What's hot

PowerShell for Penetration Testers
PowerShell for Penetration TestersPowerShell for Penetration Testers
PowerShell for Penetration Testers
Nikhil Mittal
 
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does ItAMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
Nikhil Mittal
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
0wn-premises: Bypassing Microsoft Defender for Identity
0wn-premises: Bypassing Microsoft Defender for Identity0wn-premises: Bypassing Microsoft Defender for Identity
0wn-premises: Bypassing Microsoft Defender for Identity
Nikhil Mittal
 
Understanding Windows Access Token Manipulation
Understanding Windows Access Token ManipulationUnderstanding Windows Access Token Manipulation
Understanding Windows Access Token Manipulation
Justin Bui
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeam
Dan Vasile
 
Breach and attack simulation tools
Breach and attack simulation toolsBreach and attack simulation tools
Breach and attack simulation tools
Bangladesh Network Operators Group
 
The Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query LanguageThe Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query Language
Ross Wolf
 
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton ChuvakinFive Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Anton Chuvakin
 
OSSIM Overview
OSSIM OverviewOSSIM Overview
OSSIM Overview
n|u - The Open Security Community
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE - ATT&CKcon
 
Lateral Movement with PowerShell
Lateral Movement with PowerShellLateral Movement with PowerShell
Lateral Movement with PowerShell
kieranjacobsen
 
PowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple Teaming
Nikhil Mittal
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
Matthew Dunwoody
 
Red Team Methodology - A Naked Look
Red Team Methodology - A Naked LookRed Team Methodology - A Naked Look
Red Team Methodology - A Naked Look
Jason Lang
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
Ross Wolf
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
Jorge Orchilles
 

What's hot (20)

PowerShell for Penetration Testers
PowerShell for Penetration TestersPowerShell for Penetration Testers
PowerShell for Penetration Testers
 
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does ItAMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
 
0wn-premises: Bypassing Microsoft Defender for Identity
0wn-premises: Bypassing Microsoft Defender for Identity0wn-premises: Bypassing Microsoft Defender for Identity
0wn-premises: Bypassing Microsoft Defender for Identity
 
Understanding Windows Access Token Manipulation
Understanding Windows Access Token ManipulationUnderstanding Windows Access Token Manipulation
Understanding Windows Access Token Manipulation
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeam
 
Breach and attack simulation tools
Breach and attack simulation toolsBreach and attack simulation tools
Breach and attack simulation tools
 
The Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query LanguageThe Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query Language
 
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton ChuvakinFive Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
 
OSSIM Overview
OSSIM OverviewOSSIM Overview
OSSIM Overview
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
 
Lateral Movement with PowerShell
Lateral Movement with PowerShellLateral Movement with PowerShell
Lateral Movement with PowerShell
 
PowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple Teaming
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
 
Red Team Methodology - A Naked Look
Red Team Methodology - A Naked LookRed Team Methodology - A Naked Look
Red Team Methodology - A Naked Look
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
 

Similar to Detecting modern PowerShell attacks with SIEM

Standard logs made into actionable detects
Standard logs made into actionable detectsStandard logs made into actionable detects
Standard logs made into actionable detects
Justin Henderson
 
GCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection AnalystGCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection Analyst
Justin Henderson
 
Alexey Sintsov- SDLC - try me to implement
Alexey Sintsov- SDLC - try me to implementAlexey Sintsov- SDLC - try me to implement
Alexey Sintsov- SDLC - try me to implement
DefconRussia
 
Episode 20 - Trigger Frameworks in Salesforce
Episode 20 - Trigger Frameworks in SalesforceEpisode 20 - Trigger Frameworks in Salesforce
Episode 20 - Trigger Frameworks in Salesforce
Jitendra Zaa
 
Logicalis Security Conference
Logicalis Security ConferenceLogicalis Security Conference
Logicalis Security Conference
Paul Dutot IEng MIET MBCS CITP OSCP CSTM
 
An Introduction to PowerShell for Security Assessments
An Introduction to PowerShell for Security AssessmentsAn Introduction to PowerShell for Security Assessments
An Introduction to PowerShell for Security Assessments
EnclaveSecurity
 
Security Automation and Orchestration
Security Automation and OrchestrationSecurity Automation and Orchestration
Security Automation and Orchestration
Greg Foss
 
An Introduction to PowerShell for Security Assessments
An Introduction to PowerShell for Security AssessmentsAn Introduction to PowerShell for Security Assessments
An Introduction to PowerShell for Security Assessments
EnclaveSecurity
 
Security automation simplified: an intro to DIY security automation
Security automation simplified: an intro to DIY security automationSecurity automation simplified: an intro to DIY security automation
Security automation simplified: an intro to DIY security automation
Moses Schwartz
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
Sunny Neo
 
Application Security within Agile
Application Security within AgileApplication Security within Agile
Application Security within Agile
Netlight Consulting
 
Securing the continuous integration
Securing the continuous integrationSecuring the continuous integration
Securing the continuous integration
Irene Michlin
 
When Security Tools Fail You
When Security Tools Fail YouWhen Security Tools Fail You
When Security Tools Fail You
Michael Gough
 
Defcon Blue Team Village 2020: Purple On My Mind: Cost Effective Automated Ad...
Defcon Blue Team Village 2020: Purple On My Mind: Cost Effective Automated Ad...Defcon Blue Team Village 2020: Purple On My Mind: Cost Effective Automated Ad...
Defcon Blue Team Village 2020: Purple On My Mind: Cost Effective Automated Ad...
Mauricio Velazco
 
Try {stuff} Catch {hopefully not} - Evading Detection & Covering Tracks
Try {stuff} Catch {hopefully not} - Evading Detection & Covering TracksTry {stuff} Catch {hopefully not} - Evading Detection & Covering Tracks
Try {stuff} Catch {hopefully not} - Evading Detection & Covering Tracks
Yossi Sassi
 
CSF18 - Moving from Reactive to Proactive Security - Sami Laiho
CSF18 - Moving from Reactive to Proactive Security - Sami LaihoCSF18 - Moving from Reactive to Proactive Security - Sami Laiho
CSF18 - Moving from Reactive to Proactive Security - Sami Laiho
NCCOMMS
 
A New Security Management Approach for Agile Environments
A New Security Management Approach for Agile EnvironmentsA New Security Management Approach for Agile Environments
A New Security Management Approach for Agile Environments
PECB
 
Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...
Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...
Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...
NoNameCon
 
7.1. SDLC try me to implenment
7.1. SDLC try me to implenment7.1. SDLC try me to implenment
7.1. SDLC try me to implenment
defconmoscow
 
Agile security
Agile securityAgile security
Agile security
Arthur Donkers
 

Similar to Detecting modern PowerShell attacks with SIEM (20)

Standard logs made into actionable detects
Standard logs made into actionable detectsStandard logs made into actionable detects
Standard logs made into actionable detects
 
GCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection AnalystGCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection Analyst
 
Alexey Sintsov- SDLC - try me to implement
Alexey Sintsov- SDLC - try me to implementAlexey Sintsov- SDLC - try me to implement
Alexey Sintsov- SDLC - try me to implement
 
Episode 20 - Trigger Frameworks in Salesforce
Episode 20 - Trigger Frameworks in SalesforceEpisode 20 - Trigger Frameworks in Salesforce
Episode 20 - Trigger Frameworks in Salesforce
 
Logicalis Security Conference
Logicalis Security ConferenceLogicalis Security Conference
Logicalis Security Conference
 
An Introduction to PowerShell for Security Assessments
An Introduction to PowerShell for Security AssessmentsAn Introduction to PowerShell for Security Assessments
An Introduction to PowerShell for Security Assessments
 
Security Automation and Orchestration
Security Automation and OrchestrationSecurity Automation and Orchestration
Security Automation and Orchestration
 
An Introduction to PowerShell for Security Assessments
An Introduction to PowerShell for Security AssessmentsAn Introduction to PowerShell for Security Assessments
An Introduction to PowerShell for Security Assessments
 
Security automation simplified: an intro to DIY security automation
Security automation simplified: an intro to DIY security automationSecurity automation simplified: an intro to DIY security automation
Security automation simplified: an intro to DIY security automation
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
 
Application Security within Agile
Application Security within AgileApplication Security within Agile
Application Security within Agile
 
Securing the continuous integration
Securing the continuous integrationSecuring the continuous integration
Securing the continuous integration
 
When Security Tools Fail You
When Security Tools Fail YouWhen Security Tools Fail You
When Security Tools Fail You
 
Defcon Blue Team Village 2020: Purple On My Mind: Cost Effective Automated Ad...
Defcon Blue Team Village 2020: Purple On My Mind: Cost Effective Automated Ad...Defcon Blue Team Village 2020: Purple On My Mind: Cost Effective Automated Ad...
Defcon Blue Team Village 2020: Purple On My Mind: Cost Effective Automated Ad...
 
Try {stuff} Catch {hopefully not} - Evading Detection & Covering Tracks
Try {stuff} Catch {hopefully not} - Evading Detection & Covering TracksTry {stuff} Catch {hopefully not} - Evading Detection & Covering Tracks
Try {stuff} Catch {hopefully not} - Evading Detection & Covering Tracks
 
CSF18 - Moving from Reactive to Proactive Security - Sami Laiho
CSF18 - Moving from Reactive to Proactive Security - Sami LaihoCSF18 - Moving from Reactive to Proactive Security - Sami Laiho
CSF18 - Moving from Reactive to Proactive Security - Sami Laiho
 
A New Security Management Approach for Agile Environments
A New Security Management Approach for Agile EnvironmentsA New Security Management Approach for Agile Environments
A New Security Management Approach for Agile Environments
 
Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...
Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...
Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...
 
7.1. SDLC try me to implenment
7.1. SDLC try me to implenment7.1. SDLC try me to implenment
7.1. SDLC try me to implenment
 
Agile security
Agile securityAgile security
Agile security
 

Recently uploaded

How to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For FlutterHow to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For Flutter
Daiki Mogmet Ito
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
panagenda
 
Taking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdfTaking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdf
ssuserfac0301
 
AI-Powered Food Delivery Transforming App Development in Saudi Arabia.pdf
AI-Powered Food Delivery Transforming App Development in Saudi Arabia.pdfAI-Powered Food Delivery Transforming App Development in Saudi Arabia.pdf
AI-Powered Food Delivery Transforming App Development in Saudi Arabia.pdf
Techgropse Pvt.Ltd.
 
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdfUni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems S.M.S.A.
 
Ocean lotus Threat actors project by John Sitima 2024 (1).pptx
Ocean lotus Threat actors project by John Sitima 2024 (1).pptxOcean lotus Threat actors project by John Sitima 2024 (1).pptx
Ocean lotus Threat actors project by John Sitima 2024 (1).pptx
SitimaJohn
 
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AIMind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
Kumud Singh
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
Pixlogix Infotech
 
Choosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptxChoosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptx
Brandon Minnick, MBA
 
Fueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte WebinarFueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte Webinar
Zilliz
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
akankshawande
 
CAKE: Sharing Slices of Confidential Data on Blockchain
CAKE: Sharing Slices of Confidential Data on BlockchainCAKE: Sharing Slices of Confidential Data on Blockchain
CAKE: Sharing Slices of Confidential Data on Blockchain
Claudio Di Ciccio
 
“I’m still / I’m still / Chaining from the Block”
“I’m still / I’m still / Chaining from the Block”“I’m still / I’m still / Chaining from the Block”
“I’m still / I’m still / Chaining from the Block”
Claudio Di Ciccio
 
GenAI Pilot Implementation in the organizations
GenAI Pilot Implementation in the organizationsGenAI Pilot Implementation in the organizations
GenAI Pilot Implementation in the organizations
kumardaparthi1024
 
Things to Consider When Choosing a Website Developer for your Website | FODUU
Things to Consider When Choosing a Website Developer for your Website | FODUUThings to Consider When Choosing a Website Developer for your Website | FODUU
Things to Consider When Choosing a Website Developer for your Website | FODUU
FODUU
 
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Speck&Tech
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
Zilliz
 
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdfMonitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Tosin Akinosho
 
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
Tomaz Bratanic
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
Ivanti
 

Recently uploaded (20)

How to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For FlutterHow to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For Flutter
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
 
Taking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdfTaking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdf
 
AI-Powered Food Delivery Transforming App Development in Saudi Arabia.pdf
AI-Powered Food Delivery Transforming App Development in Saudi Arabia.pdfAI-Powered Food Delivery Transforming App Development in Saudi Arabia.pdf
AI-Powered Food Delivery Transforming App Development in Saudi Arabia.pdf
 
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdfUni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdf
 
Ocean lotus Threat actors project by John Sitima 2024 (1).pptx
Ocean lotus Threat actors project by John Sitima 2024 (1).pptxOcean lotus Threat actors project by John Sitima 2024 (1).pptx
Ocean lotus Threat actors project by John Sitima 2024 (1).pptx
 
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AIMind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
 
Choosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptxChoosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptx
 
Fueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte WebinarFueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte Webinar
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
 
CAKE: Sharing Slices of Confidential Data on Blockchain
CAKE: Sharing Slices of Confidential Data on BlockchainCAKE: Sharing Slices of Confidential Data on Blockchain
CAKE: Sharing Slices of Confidential Data on Blockchain
 
“I’m still / I’m still / Chaining from the Block”
“I’m still / I’m still / Chaining from the Block”“I’m still / I’m still / Chaining from the Block”
“I’m still / I’m still / Chaining from the Block”
 
GenAI Pilot Implementation in the organizations
GenAI Pilot Implementation in the organizationsGenAI Pilot Implementation in the organizations
GenAI Pilot Implementation in the organizations
 
Things to Consider When Choosing a Website Developer for your Website | FODUU
Things to Consider When Choosing a Website Developer for your Website | FODUUThings to Consider When Choosing a Website Developer for your Website | FODUU
Things to Consider When Choosing a Website Developer for your Website | FODUU
 
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
 
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdfMonitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdf
 
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
 

Detecting modern PowerShell attacks with SIEM

  • 1. SEC555 Detecting Modern PowerShell Attacks with SIEM Justin Henderson (GSE # 108) and Tim Garcia (SANS Certified Instructor) @SecurityMapper Presentation based on SEC555: SIEM with Tactical Analytics
  • 2. SEC555 | SIEM with Tactical Analytics 2 About Us Justin Henderson • Author of SEC555: SIEM with Tactical Analytics • GIAC GSE # 108, Cyber Guardian Blue and Red • 58 industry certifications (need to get a new hobby) Tim Garcia • Information Security Engineer • SANS Certified Instructor Cyber Defense curriculum (SEC 301, 401, 501, 511, and 555)
  • 3. SEC555 | SIEM with Tactical Analytics 3 Welcome! A copy of this talk is available at: https://github.com/SMAPPER/presentations More free stuff: https://github.com/HASecuritySolutions Special Thanks: Thank you to Lee Holmes and the Microsoft PowerShell team for their research and pure awesomeness!
  • 4. SEC555 | SIEM with Tactical Analytics 4 PowerShell Awesomeness PowerShell is one of the BEST things that ever happened • For both defense and offense • It is an equal opportunity employer Defenders • Automate everything (firewalls, IDS, etc.) • Administration, Auditing, Hunt teaming, and much more Attackers • Completely own you and bypass controls
  • 5. SEC555 | SIEM with Tactical Analytics 5 PowerShell = Attacker's Choice Award Attackers/malware love PowerShell, but why? • On lots of systems with multiple versions • Almost always enabled and allowed • Whitelisting - Allowed • Antivirus - Allowed • NextGen whatever / EDR - Allowed • Can be enabled remotely even if currently disabled • Lots of pre-built attacks available using PowerShell
  • 6. SEC555 | SIEM with Tactical Analytics 6 Sample of PowerShell Evilness Common attack tools and frameworks available: • PowerSploit - Collection of evil modules and goodies • PowerShell Empire - Post-exploitation agent framework • Nishang - Useful all around pentesting framework • Invoke-Mimikatz - Memory based version of Mimikatz Attack Devices • Rubber Ducky - Keyboard emulation • Bash Bunny - Pure evilness with a cute bunny
  • 7. SEC555 | SIEM with Tactical Analytics 7 Disabling PowerShell If PowerShell is so evil why not just disable it? • You need it… You really, truly need it • Automation is key tool in a defenders toolbelt • The good can/should outweigh the bad In a world without PowerShell… • Attackers would simply pick a different attack vector • Your defense capabilities would be weak
  • 8. SEC555 | SIEM with Tactical Analytics 8 PowerShell Prevention Talk is primarily around detection rather than prevention • Specifically using logs and a SIEM (super powerful) Worth mentioning some PowerShell security mechanisms • ExecutionPolicy - Not really a security feature • Just Enough Administration (JEA) - Controls who can do what with PowerShell • Constrained Language Mode - Limits certain functionality often used by malware (non-core features)
  • 9. SEC555 | SIEM with Tactical Analytics 9 Catching PowerShell Evil Ideally you want to catch PowerShell attacks… at scale • For this we need SIEM + log sources Key PowerShell data sources • Module logging • Script Block logging • Transcription logging • Process creation events • Sysinternals Sysmon logs PowerShell specific Command line logging
  • 10. SEC555 | SIEM with Tactical Analytics 10 Module Logging Enables Event ID 4103 • Records module use • And parameters • Very verbose…
  • 11. SEC555 | SIEM with Tactical Analytics 11 Module Logging Example Invoke-Mimikatz.ps1 ran on Windows 7 box with PS v5.1 • 8,555 events logged from running script once • Includes functions and parameters called • Logs based on every time a module is used
  • 12. SEC555 | SIEM with Tactical Analytics 12 Script Block Logging PowerShell v5 added Script Block Logging (Event ID 4104) • Records blocks as they are executed • If too large spans multiple events • Data is decoded in log • Event type of WARNING used to log suspicious commands • WARNING events enabled by default • Can log start/stop times (4105, 4106)
  • 13. SEC555 | SIEM with Tactical Analytics 13 Script Block Logging Example Invoke-Mimikatz.ps1 on same system = 509 events • Volume is a bit more easy to handle • But still a lot of data Includes what is executed only • Does not log output
  • 14. SEC555 | SIEM with Tactical Analytics 14 Transcription Logging Also introduced in v5 was transcription logging • Contains both input and output • Saves to a file Default: “My DocumentsyyyyMMdd” • Location can be changed to centralized location
  • 15. SEC555 | SIEM with Tactical Analytics 15 Transcription Example
  • 16. SEC555 | SIEM with Tactical Analytics 16 Endpoint Logging Today, client-side attacks are more common • Means the attack occurs at the desktop • Which means you need desktop logs… Yet, cost of desktop logs is considered too high • If strategy is collect everything, that is true • If strategy is to stay nimble and tactical, it is more expensive not to log… Advanced agent filtering is helpful or file server tricks
  • 17. SEC555 | SIEM with Tactical Analytics 17 PowerShell Command Line (Event ID: 4688) PowerShell is now commonly used for modern attacks
  • 18. SEC555 | SIEM with Tactical Analytics 18 Command Line Adversaries like to bypass script files due to AV detection • Thus long, obfuscated commands are common • Or calls to download and execute code are made • Another example of their strength = their weakness Key augmentations for discovery: • Command line length (> 500 is odd) • Base64 discovery • Execution of downloaded code
  • 19. SEC555 | SIEM with Tactical Analytics 19 Command Line Length
  • 20. SEC555 | SIEM with Tactical Analytics 20 Base64 Encoding Common to see base64 encoded PowerShell attacks • Can be extracted using regex and then decoded Example: (?<base64_code>[A-Za-z0-9+/]{50,}[=]{0,2})
  • 21. SEC555 | SIEM with Tactical Analytics 21 Download and Execute Code can be downloaded and run to minimize length • Also works with base64 encoding Invoke-Expression (iex) runs commands passed to it • Net.WebClient acts as a PowerShell web browser
  • 22. SEC555 | SIEM with Tactical Analytics 22 PowerShell Downgrade Attacks PowerShell v5 awesome security features • Bad guys do not like v5 • But v5 systems have v2 - v5 Downgrade attacks bypass security • Except Event ID 400 gives it away • Look for EngineVersion less than 5
  • 23. SEC555 | SIEM with Tactical Analytics 23 PowerShell Command Monitoring JEA requires modifications and process changes • Alternative solution is to parse and monitor commands from module logging Group regex match can extract all commands to an array Parses into
  • 24. SEC555 | SIEM with Tactical Analytics 24 PowerShell Whitelist Detection Alternative method can be used to export all cmdlets • Export from trusted systems • Use as whitelist of cmdlets • Then alert on anything new Can be expanded to include • Parameters • Users • Systems
  • 25. SEC555 | SIEM with Tactical Analytics 25 PowerShell Without PowerShell PowerShell does not equal PowerShell.exe • It can be loaded using DLLs System.Management.Automation.Dll System.Management.Automation.ni.Dll System.Reflection.Dll Catching requires monitoring DLL load events • Such as with Sysmon Event ID 7 or commercial software
  • 26. SEC555 | SIEM with Tactical Analytics 26 Sysmon PowerShell Example
  • 27. SEC555 | SIEM with Tactical Analytics 27 Summary PowerShell is awesome yet scary • Learn it, know about it, and detect unauthorized use Simple detects can find a lot • Look for long command line lengths • Look for encoding • Check cmdlets against whitelist == Totally awesome • Look for downgrade attempts • Look for PowerShell use outside powershell.exe