topic Re: Detect and Restrict Powershell cmdlets in Cortex XDR Discussions

Detect and Restrict Powershell cmdlets

agirones — Tue, 23 Apr 2024 14:57:14 GMT

Hello everyone,

I would like to know if any of you have struggled with support and technical cases with the need I show below.

I would like to know what you can tell me or give me your opinion about taking action against powershell cmdlets.

After several cases and meetings with support, I can't get a solid answer to my needs about restricting some powershell cmdlets.

I hope to find a solution that fits my needs, thanks anyway.

Re: Detect and Restrict Powershell cmdlets

jmazzeo — Tue, 23 Apr 2024 17:37:22 GMT

Hi @agirones, thanks for reaching us using the Live Community.

Can you share more information about what cmdlets you are trying to detect or block? Do you have some example?

Maybe I can do some test in my lab and try to help you.

Re: Detect and Restrict Powershell cmdlets

agirones — Wed, 24 Apr 2024 06:25:31 GMT

Hi @jmazzeo, thaks for your interest and trying to help!

Example, I want to restrict cmdlet like:

Set-ItemProperty -Path
Remove-ItemProperty -Path
Invoke-AADintReconAsOutsider
Remove-DomainObjectACL

Re: Detect and Restrict Powershell cmdlets

jmazzeo — Wed, 24 Apr 2024 14:27:04 GMT

Hi @agirones, I believe that this could work for you.

Create a new custom BIOC rule going to Detection Rules - BIOC
Select the Event Log type. The powershell cmdlets details are taken from the windows event log.
Set a name, and put all the required commands in the "Message" field in this format:

*Set-ItemProperty -Path*|*Remove-ItemProperty -Path*|*Invoke-AADintReconAsOutsider*|*Remove-DomainObjectACL*

Use the "|" character as an OR separator, and the "*" as wildcard.

Before save it you can test it to check if you have some matching events.
You will see the command details by opening the "View event log message" from the results.
This is how you will see the details:
Alerts generated:

This works for cmdlets running in a live powershell console in the host, and it will also detect this commands running from scripts.

The "Event log" type BIOC Rules can't be used to block, only for notifications.

If this post answers your question, please mark it as the solution.

Re: Detect and Restrict Powershell cmdlets

agirones — Wed, 24 Apr 2024 16:09:02 GMT

Hey @jmazzeo,

Thanks, I know this detection functionality, together with an automation with "terminate casuality chain" that kills the powershell process can be a "solution".

This feature requires XTH - Xtended Threat Hunting license (which I don't have).

The only drawback I see to this solution is that it is an asynchronous solution (it works after executing the command, in this case the cmdlet).