PowerShell security software discovery via Get-Process piped to Where-Object on Windows

title: PowerShell security software discovery via Get-Process piped to Where-Object on Windows
id: 05e2dd76-f93b-4fc4-a14e-22616c8d934e
status: test
description: This rule matches PowerShell ScriptBlock content that uses Get-Process (or gps) piped to Where-Object filtering, along with additional process-property filters (Company/Description/Name/Path/Product) and keywords associated with security vendors or products. Such discovery can help an attacker identify defensive tools, sensors, and related software present on the host or in a cloud environment. The detection relies on ScriptBlockText telemetry from Windows PowerShell script execution and filters that indicate both process enumeration and security-software-focused searching.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml
author: frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-16
modified: 2023-10-24
tags:
  - attack.discovery
  - attack.t1518.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      - get-process | \?
      - get-process | where
      - gps | \?
      - gps | where
  selection_field:
    ScriptBlockText|contains:
      - Company -like
      - Description -like
      - Name -like
      - Path -like
      - Product -like
  selection_keywords:
    ScriptBlockText|contains:
      - \*avira\*
      - \*carbonblack\*
      - \*cylance\*
      - \*defender\*
      - \*kaspersky\*
      - \*malware\*
      - \*sentinel\*
      - \*symantec\*
      - \*virus\*
  condition: all of selection_*
falsepositives:
  - False positives might occur due to the nature of the ScriptBlock being ingested as a big blob. Initial tuning is required.
  - As the "selection_cmdlet" is common in scripts the matching engine might slow down the search. Change into regex or a more accurate string to avoid heavy resource consumption if experienced
level: medium
license: DRL-1.1
related:
  - id: 904e8e61-8edf-4350-b59c-b905fc8e810c
    type: derived