topic Process Hunting - Powershell + WGET typing manualy in Cortex XDR Discussions

Process Hunting - Powershell + WGET typing manualy

Cyber1985 — Mon, 06 Jun 2022 21:19:07 GMT

Hello dear community,

is there a way to hunt for a manually started powershell.exe where a attacker started wget.

In this case I opened cmd and typed this CMD in. Cortex XDR recognized it.

But when I manualy open powershell and type in manualy wget google.at Cortex XDR doesn't recognize the parameters in the powershell with my query.

What is the best way to track starting wget in powershell?

Rob

Re: Process Hunting - Powershell + WGET typing manualy

afurze — Mon, 06 Jun 2022 21:49:25 GMT

Hi Cyber1985,

There's some Windows nuance happening here which is tripping you up. When you used CMD to launch Powershell, Cortex examined the command line arguments passed to powershell (i.e. powershell.exe wget [site_url]) and was able to match "wget", however, when you type "wget" into an interactive Powershell window, there are no command line arguments to examine, it all happens within the interactive shell without spawning a subprocess as was the case with CMD.

To detect this, you will need to have Powershell logging enabled shown here from Microsoft, https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.2.

Assuming you have Cortex XDR Pro per Endpoint, Windows Event logs are ingested and can be searched.

Re: Process Hunting - Powershell + WGET typing manualy

Cyber1985 — Mon, 06 Jun 2022 22:23:55 GMT

Hey Afurze,

nice nickname, is it german?

I tested it and it worked on my machine. So, we will need to activate the PowerShell logging on every domain.

Thanks a lot!

Rob

Re: Process Hunting - Powershell + WGET typing manualy

NathanBradley — Tue, 07 Jun 2022 15:13:01 GMT

is there a list of windows event logs thats are collected? i was not aware powershell event logs are available in cortex

Re: Process Hunting - Powershell + WGET typing manualy

afurze — Tue, 07 Jun 2022 15:17:42 GMT

Here is the article which outlines what Windows Event Logs are collected by Cortex.