Sunturai
Back to results
MediumSigmaHQfrack113 +2

Security Software Discovery Via Powershell Script

Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes. Adversaries may attempt to get a listing of security software, configurations, defensive…

Description

Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes. Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus

Detection logic

Detection requirements

Platform
IaaSLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
windows
Log source category
ps_script

Known benign triggers

  • As the "selection_cmdlet" is common in scripts the matching engine might slow down the search. Change into regex or a more accurate string to avoid heavy resource consumption if experienced
  • False positives might occur due to the nature of the ScriptBlock being ingested as a big blob. Initial tuning is required.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice