11name : PowerShell 4104 Hunting
22id : d6f2b006-0041-11ec-8885-acde48001122
3- version : 16
4- date : ' 2025-05-02 '
3+ version : ' 17 '
4+ date : ' 2025-05-06 '
55author : Michael Haag, Splunk
66status : production
77type : Hunting
8- description :
9- The following analytic identifies suspicious PowerShell execution using
8+ description : The following analytic identifies suspicious PowerShell execution using
109 Script Block Logging (EventCode 4104). It leverages specific patterns and keywords
1110 within the ScriptBlockText field to detect potentially malicious activities. This
1211 detection is significant for SOC analysts as PowerShell is commonly used by attackers
@@ -15,9 +14,8 @@ description:
1514 execute arbitrary commands, exfiltrate data, or maintain long-term access to the
1615 compromised system, posing a severe threat to the organization's security.
1716data_source :
18- - Powershell Script Block Logging 4104
19- search :
20- ' `powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"),
17+ - Powershell Script Block Logging 4104
18+ search : ' `powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"),
2119 "4", 0) | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)")
2220 OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) |
2321 eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0)
@@ -45,52 +43,52 @@ search:
4543 compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal,
4644 reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd | rename Computer
4745 as dest, UserID as user | `powershell_4104_hunting_filter`'
48- how_to_implement :
49- The following Hunting analytic requires PowerShell operational logs
46+ how_to_implement : The following Hunting analytic requires PowerShell operational logs
5047 to be imported. Modify the powershell macro as needed to match the sourcetype or
5148 add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
5249known_false_positives : Limited false positives. May filter as needed.
5350references :
54- - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md
55- - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell
56- - https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt
57- - https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
58- - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
59- - https://www.mandiant.com/resources/greater-visibilityt
60- - https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
61- - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
62- - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
51+ - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md
52+ - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell
53+ - https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt
54+ - https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
55+ - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
56+ - https://www.mandiant.com/resources/greater-visibilityt
57+ - https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
58+ - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
59+ - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
6360tags :
6461 analytic_story :
65- - Braodo Stealer
66- - Cactus Ransomware
67- - China-Nexus Threat Activity
68- - CISA AA23-347A
69- - CISA AA24-241A
70- - Cleo File Transfer Software
71- - DarkGate Malware
72- - Data Destruction
73- - Flax Typhoon
74- - Hermetic Wiper
75- - Lumma Stealer
76- - Malicious PowerShell
77- - Medusa Ransomware
78- - Rhysida Ransomware
79- - Salt Typhoon
80- - SystemBC
81- - PHP-CGI RCE Attack on Japanese Organizations
82- - Water Gamayun
62+ - CISA AA23-347A
63+ - China-Nexus Threat Activity
64+ - Data Destruction
65+ - PHP-CGI RCE Attack on Japanese Organizations
66+ - Hermetic Wiper
67+ - Medusa Ransomware
68+ - Braodo Stealer
69+ - Cleo File Transfer Software
70+ - Lumma Stealer
71+ - Salt Typhoon
72+ - Cactus Ransomware
73+ - Malicious PowerShell
74+ - Water Gamayun
75+ - XWorm
76+ - Flax Typhoon
77+ - CISA AA24-241A
78+ - Rhysida Ransomware
79+ - SystemBC
80+ - DarkGate Malware
8381 asset_type : Endpoint
8482 mitre_attack_id :
85- - T1059.001
83+ - T1059.001
8684 product :
87- - Splunk Enterprise
88- - Splunk Enterprise Security
89- - Splunk Cloud
85+ - Splunk Enterprise
86+ - Splunk Enterprise Security
87+ - Splunk Cloud
9088 security_domain : endpoint
9189tests :
92- - name : True Positive Test
93- attack_data :
94- - data : https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
95- source : XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
96- sourcetype : XmlWinEventLog
90+ - name : True Positive Test
91+ attack_data :
92+ - data : https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
93+ source : XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
94+ sourcetype : XmlWinEventLog
0 commit comments