[rule]
description = """
Identifies the execution of a PowerShell script that may allow remote commands execution via TCP, UDP or ICMP reverse
shell.
"""
id = "a4a0537b-040e-4319-afce-a71ea547d45d"
license = "Elastic License v2"
name = "Potential Reverse Shell via Powershell"
os_list = ["windows"]
reference = ["https://github.com/samratashok/nishang/tree/master/Shells"]
version = "1.0.2"
query = '''
api where process.Ext.api.name == "AmsiScanBuffer" and
(process.name in~ ("powershell.exe") or process.Ext.api.parameters.app_name == "PowerShell") and
process.Ext.api.parameters.buffer : ("*Sockets.TCPClient(*", "*Sockets.UDPClient(*", "*Net.NetworkInformation.Ping*") and
process.Ext.api.parameters.buffer : ("*while(*", "*while (*") and process.Ext.api.parameters.buffer : ("*.GetStream()*", "*.GetBytes(*") and
process.Ext.api.parameters.buffer : ("*.Read(*", "*.Receive(*", "*.GetString(*") and process.Ext.api.parameters.buffer : ("*.Write(*", "*.Send(*")
'''
min_endpoint_version = "8.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.16.0"