topic Re: Will the Rule Builder accept Powershell commands? in Cortex XDR Discussions

Will the Rule Builder accept Powershell commands?

Chris_Dietz — Mon, 01 May 2023 15:59:52 GMT

Will the process rule builder accept Powershell commands? or only Windows command line?

Re: Will the Rule Builder accept Powershell commands?

bbucao — Wed, 03 May 2023 14:21:50 GMT

Hi Chris_Dietz,

Yes, the CMD field in the BIOC rule builder applies to any process command line captured by the XDR agent, including powershell. You can narrow your rule down further by defining powershell.exe as the process name in the rule builder as well.

Thanks,
Ben

Re: Will the Rule Builder accept Powershell commands?

Chris_Dietz — Wed, 03 May 2023 14:30:09 GMT

Thanks Ben! What do I do if I have a multiple line command? Do I just paste it all in there?

Re: Will the Rule Builder accept Powershell commands?

bbucao — Wed, 03 May 2023 17:04:10 GMT

Hi Chris_Dietz,

I may have misunderstood your original question. The logic you use to match the traffic will depend on how it was executed. If a command prompt is used to execute powershell commands such as powershell.exe Write-Host "Hello, World!", You could use the process rule builder to match on the command line. If the command/commands were executed through a powershell terminal you can try using the query below as a template to create rules off of. You can add any number of filtering criteria on the "content" field which should result in matches on your identified powershell activity. I do recommend running some test powershell commands and validating that you can match on it using a variation of the below query, which is valid to save as a BIOC rule.

dataset = xdr_data
| filter event_type = EVENT_LOG and action_evtlog_message = "AmsiScanBuffer "
| alter content = json_extract_scalar(action_evtlog_data_fields, "$.content")
|filter actor_process_image_path contains "powershell"
//| filter content contains "Write-Host Hello, World"

Thanks,
Ben

Re: Will the Rule Builder accept Powershell commands?

Chris_Dietz — Wed, 03 May 2023 17:22:31 GMT

Hi Ben,

I'm trying to take some of the Red Canary tests and add the criteria to Cortex. Here is a link to what I'm looking at to give you an idea.

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md