PowerShell Engine Loaded via Injection

[rule]
description = """
Identifies the PowerShell engine being invoked by unexpected processes. Instead of executing PowerShell functionality
with powershell.exe, some attackers do this to operate more stealthily.
"""
id = "c5473399-8d0b-4cf2-a1a2-0c856649396a"
license = "Elastic License v2"
name = "PowerShell Engine Loaded via Injection"
os_list = ["windows"]
version = "1.0.9"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and 
  process.executable : "C:\\*" and 
  not process.Ext.token.integrity_level_name : "low" and 
  not process.executable : 
               ("?:\\Windows\\System32\\WindowsPowerShell\\*.exe", 
                "?:\\Windows\\SysWOW64\\WindowsPowerShell\\*.exe", 
                "?:\\Program Files\\*.exe", 
                "?:\\Program Files (x86)\\*.exe") and 
  not (process.code_signature.status : "trusted" and 
       process.pe.original_file_name : ("LegacyVSTSPowerShellHost.exe", "SqlIaaSExtensionDeployer.exe", "wacrun.exe")) and 
  not process.hash.sha256 :
                   ("07bc2c53c47cf691b8836af4e377990324e612df16de63644c8c3750e9a75a57",
                    "8b66483519a4be8e2cd4b9686ea465e2171731a7a91f623069046450f22b7a39",
                    "2232525e0e8ba5d5877198fbe3589cc8a90b03054ee69e7f7d7c37761a88741f") and
  not process.pe.imphash in ("d41d8cd98f00b204e9800998ecf8427e", "45e4653ae633e067079dd72666b0158b") and
  not (process.code_signature.status : "trusted" and 
       process.code_signature.subject_name : 
            ("Citrix Systems, Inc.", "Veeam Software Group GmbH", "ScriptRunner Software GmbH", "Microsoft 3rd Party Application Component", 
             "Atera Networks Ltd", "Chocolatey Software, Inc.", "Chocolatey Software, Inc", "Datto Inc", "Datto, LLC", "Dell Technologies Inc.",
             "Syxsense Inc.")) and
  not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe" and
       process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe") and
  process.parent.thread.Ext.call_stack_summary : 
                    ("ntdll.dll|Unbacked", 
                     "ntdll.dll|kernelbase.dll|Unbacked",
                     "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll") and 
   not _arraysearch(process.parent.thread.Ext.call_stack, $entry, 
                    $entry.callsite_trailing_bytes : ("488b556*c6420c01833d*", "48894550488b4d18488b455048894110488b4528ff5040*"))]
 [library where dll.name : ("System.Management.Automation.ni.dll", "System.Management.Automation.dll")]
'''

min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.8.0"