PowerShell MsXml2 XmlHttp via COM Object Creation

title: PowerShell MsXml2 XmlHttp via COM Object Creation
id: b55e56e4-fd36-461c-beb2-d1bb210852a0
status: test
description: This rule flags PowerShell script block content that creates a COM object referencing MsXml2.XmlHttp, using New-Object with -ComObject. Such behavior can be used to programmatically send HTTP requests or interact with COM-based components, which attackers may leverage for execution, data retrieval, or staging. The detection relies on Windows PowerShell Script Block Logging and matches the presence of the specific New-Object -ComObject MsXml2.XmlHttp strings within the script block text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt
  - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85)
  - https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_msxml_com.yml
author: frack113, MatilJ, Huntrule Team
date: 2022-01-19
modified: 2022-05-19
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - New-Object
      - -ComObject
      - MsXml2.
      - XmlHttp
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: 78aa1347-1517-4454-9982-b338d6df8343
    type: derived