Windows PowerShell Stores Command Output in Alternate Data Streams via Start-Process

title: Windows PowerShell Stores Command Output in Alternate Data Streams via Start-Process
id: b2a761f6-714d-4f72-b196-1c3197efd5e2
status: test
description: This rule matches PowerShell script block text where Start-Process is used to launch the Windows command interpreter ("$env:comspec") with an ArgumentList and output redirection using ">". Such redirection can be used to write data to non-standard locations, including Alternate Data Streams, which attackers may use to hide artifacts and reduce forensic visibility. It relies on Script Block Logging telemetry that captures the exact PowerShell script text containing the specified Start-Process and redirection parameters.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_store_file_in_alternate_data_stream.yml
author: frack113, Huntrule Team
date: 2021-09-02
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_compspec:
    ScriptBlockText|contains|all:
      - Start-Process
      - '-FilePath "$env:comspec" '
      - "-ArgumentList "
      - ">"
  condition: selection_compspec
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a699b30e-d010-46c8-bbd1-ee2e26765fe9
    type: derived