PowerShell Security Software Discovery Using get-process Piped to where-object (Windows)

title: PowerShell Security Software Discovery Using get-process Piped to where-object (Windows)
id: 05e2dd76-f93b-4fc4-a14e-22616c8d934e
status: test
description: This rule identifies PowerShell script blocks that enumerate running processes using get-process (or gps) and immediately pipe results to a where-object filter. It further looks for process property filters (e.g., Company/Description/Name/Path/Product) combined with keywords associated with security products and sensors such as antivirus, defender, and specific vendor terms. Such discovery can help attackers identify installed defensive tooling and tailor follow-on actions. The detection relies on ScriptBlockText content from PowerShell Script Block Logging.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml
author: frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-16
modified: 2023-10-24
tags:
  - attack.discovery
  - attack.t1518.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      - get-process | \?
      - get-process | where
      - gps | \?
      - gps | where
  selection_field:
    ScriptBlockText|contains:
      - Company -like
      - Description -like
      - Name -like
      - Path -like
      - Product -like
  selection_keywords:
    ScriptBlockText|contains:
      - \*avira\*
      - \*carbonblack\*
      - \*cylance\*
      - \*defender\*
      - \*kaspersky\*
      - \*malware\*
      - \*sentinel\*
      - \*symantec\*
      - \*virus\*
  condition: all of selection_*
falsepositives:
  - False positives might occur due to the nature of the ScriptBlock being ingested as a big blob. Initial tuning is required.
  - As the "selection_cmdlet" is common in scripts the matching engine might slow down the search. Change into regex or a more accurate string to avoid heavy resource consumption if experienced
level: medium
license: DRL-1.1
related:
  - id: 904e8e61-8edf-4350-b59c-b905fc8e810c
    type: derived