Windows Process Creation: PowerShell COM CLSID Download Cradles

Alerts on PowerShell command lines using GetTypeFromCLSID with selected CLSIDs that may be used to download files via COM.

FreeUnreviewedSigmamediumv1

windows-process-creation-powershell-com-clsid-download-cradles-02b64f1b

title: "Windows Process Creation: PowerShell COM CLSID Download Cradles"
id: ca9039a5-01df-400e-806a-ca1831ee3e99
related:
  - id: 3c7d1587-3b13-439f-9941-7d14313dbdfe
    type: similar
  - id: 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf
    type: derived
status: test
description: This rule flags process creation events where a command line contains the PowerShell pattern [Type]::GetTypeFromCLSID( and matches specific CLSIDs associated with COM objects that can be used as download cradles. Attackers may leverage COM activation via PowerShell to retrieve external content and enable follow-on execution. The detection relies on Windows process creation telemetry with the full command line, including the CLSID values and the GetTypeFromCLSID call pattern.
references:
  - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_download_com_cradles.yml
author: frack113, Huntrule Team
date: 2022-12-25
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  product: windows
  category: process_creation
detection:
  selection_1:
    CommandLine|contains: "[Type]::GetTypeFromCLSID("
  selection_2:
    CommandLine|contains:
      - 0002DF01-0000-0000-C000-000000000046
      - F6D90F16-9C73-11D3-B32E-00C04F990BB4
      - F5078F35-C551-11D3-89B9-0000F81FE221
      - 88d96a0a-f192-11d4-a65f-0040963251e5
      - AFBA6B42-5692-48EA-8141-DC517DCF0EF1
      - AFB40FFD-B609-40A3-9828-F88BBE11E4E3
      - 88d96a0b-f192-11d4-a65f-0040963251e5
      - 2087c2f4-2cef-4953-a8ab-66779b670495
      - 000209FF-0000-0000-C000-000000000046
      - 00024500-0000-0000-C000-000000000046
  condition: all of selection_*
falsepositives:
  - Legitimate use of the library
level: medium
license: DRL-1.1

What it detects

This rule flags process creation events where a command line contains the PowerShell pattern [Type]::GetTypeFromCLSID( and matches specific CLSIDs associated with COM objects that can be used as download cradles. Attackers may leverage COM activation via PowerShell to retrieve external content and enable follow-on execution. The detection relies on Windows process creation telemetry with the full command line, including the CLSID values and the GetTypeFromCLSID call pattern.

Known false positives

Legitimate use of the library

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.