HackTool - CrackMapExec PowerShell Obfuscation
A Sigma rule for process creation on Windows, by Thomas Patzke.
high 2 ATT&CK techniques 2 programs it names 2 everyday examples trip it
What it looks for
detection:
selection_cli:
CommandLine|contains:
- 'join*split'
- '( $ShellId[1]+$ShellId[13]+''x'')'
- '( $PSHome[*]+$PSHOME[*]+'
- '( $env:Public[13]+$env:Public[5]+''x'')'
- '( $env:ComSpec[4,*,25]-Join'''')'
- '[1,3]+''x''-Join'''')'
selection_img:
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
condition: all of selection_*
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Thomas Patzke, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Encrypt an exported credential object on the page for Export-Clixml
$Credxmlpath = Join-Path (Split-Path $PROFILE) TestScript.ps1.credential
$Credential | Export-Clixml $Credxmlpath
$Credxmlpath = Join-Path (Split-Path $PROFILE) TestScript.ps1.credential
$Credential = Import-Clixml $CredxmlpathIdentifyNormalizing input on the page for Read-Host
$prompt = @(
'List the cities you want weather information for.'
'When specifying multiple cities, separate them with a semi-colon, like:'
"'New York; Osan; Koforidua'"
) -join ' '
$cities = Read-Host $prompt
"Input cities string: nt'$cities'"
$splitCities = $cities -split ';'
"Split cities array:"
$splitCities | ForEach-Object -Process { "t'$_'" }
$normalizedCities = $splitCities | ForEach-Object -Process { $_.Trim() }
"Normalized split cities array:"
$normalizedCities | ForEach-Object -Process { "t'$_'" }Identify