topic Re: Cortex XDR missing powershell logging in Cortex XDR Discussions

Cortex XDR missing powershell logging

Vadim_Lisserman — Wed, 14 Feb 2024 21:22:26 GMT

I'm doing some Powershell detection testing and I noticed that when I open the Powershell GUI in windows and run a command below it doesn't trigger a Powershell detection. However, when I add powershell in front of the command it does trigger an event. I'm pretty sure this always wasn't the case. Curios to see if this is expected behavior or something is broken with XDR.

Start-BitsTransfer -Priority foreground -Source https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md -Destination c:\source\flag.ps1

Re: Cortex XDR missing powershell logging

Alejandro_Hernandez — Thu, 15 Feb 2024 01:47:03 GMT

Hi @Vadim_Lisserman

Do you have XDR pro license, and if you have it, its enable in the agents?

Re: Cortex XDR missing powershell logging

Vadim_Lisserman — Thu, 15 Feb 2024 13:48:57 GMT

Yes, and yes. Have you tried this in your environment are you seeing different results?

Re: Cortex XDR missing powershell logging

zarnous — Thu, 29 Feb 2024 22:28:21 GMT

Hi @Vadim_Lisserman

This has more to do with what was your action process vs what was the actor process, in the case where PowerShell is doing the click action/ acting it is called the actor process , and when PowerShell is being spawned by another process that calls PowerShell it is called the action process, and hence, the detection is dependent on the action process in this case, while not all detection have he same criteria but this is in your use case.

You can create custom detection as well, by utilizing the correlation rule, and in order for you to find the inspected script executed by PowerShell, you can utilize the AMSI scan buffer, that sits between the scripting engine, in our case PowerShell, and the XDR.

I have also went over this and how to look at the AMSI scan buffer content in a different post that you may check here - https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xqls-for-powershell-script-logging/td-p/542059

Hope that was helpful, and if it answers your question please feel free to mark this as a solution so others can benefit from.

Thanks
Z