sigmahighHunting

HackTool - CrackMapExec PowerShell Obfuscation

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

MITRE ATT&CK

T1059.001 T1027.005

executiondefense-evasion

Detection Query

selection_img:
  - Image|endswith:
      - \powershell.exe
      - \pwsh.exe
  - OriginalFileName:
      - PowerShell.EXE
      - pwsh.dll
selection_cli:
  CommandLine|contains:
    - join*split
    - ( $ShellId[1]+$ShellId[13]+'x')
    - ( $PSHome[*]+$PSHOME[*]+
    - ( $env:Public[13]+$env:Public[5]+'x')
    - ( $env:ComSpec[4,*,25]-Join'')
    - "[1,3]+'x'-Join'')"
condition: all of selection_*

Author

Thomas Patzke

Created

2020-05-22

Data Sources

windowsProcess Creation Events

Platforms

windows

References

Tags

attack.executionattack.t1059.001attack.defense-evasionattack.t1027.005

Raw Content

title: HackTool - CrackMapExec PowerShell Obfuscation
id: 6f8b3439-a203-45dc-a88b-abf57ea15ccf
status: test
description: The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.
references:
    - https://github.com/byt3bl33d3r/CrackMapExec
    - https://github.com/byt3bl33d3r/CrackMapExec/blob/0a49f75347b625e81ee6aa8c33d3970b5515ea9e/cme/helpers/powershell.py#L242
author: Thomas Patzke
date: 2020-05-22
modified: 2023-02-21
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1027.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli:
        CommandLine|contains:
            - 'join*split'
            # Line 343ff
            - '( $ShellId[1]+$ShellId[13]+''x'')'
            - '( $PSHome[*]+$PSHOME[*]+'
            - '( $env:Public[13]+$env:Public[5]+''x'')'
            - '( $env:ComSpec[4,*,25]-Join'''')'
            - '[1,3]+''x''-Join'''')'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high