Cortex XDR missing powershell logging

[Vadim_Lisserman]

I'm doing some Powershell detection testing and I noticed that when I open the Powershell GUI in windows and run a command below it doesn't trigger a Powershell detection.  However, when I add powershell in front of the command it does trigger an event. I'm pretty sure this always wasn't the case.  Curios to see if this is expected behavior or something is broken with XDR. 

Start-BitsTransfer -Priority foreground -Source https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md -Destination c:\source\flag.ps1

[Alejandro_Hernandez]

Hi @Vadim_Lisserman 

Do you have XDR pro license, and if you have it, its enable in the agents?

[Vadim_Lisserman]

Yes, and yes.  Have you tried this in your environment are you seeing different results?

[zarnous]

Hi @Vadim_Lisserman 

This has more to do with what was your action process vs what was the actor process, in the case where PowerShell is doing the click action/ acting it is called the actor process , and when PowerShell is being spawned by another process that calls PowerShell it is called the action process, and hence, the detection is dependent on the action process in this case, while not all detection have he same criteria but this is in your use case.

You can create custom detection as well, by utilizing the correlation rule, and in order for you to find the inspected script executed by PowerShell, you can utilize the AMSI scan buffer, that sits between the scripting engine, in our case PowerShell, and the XDR.

I have also went over this and how to look at the AMSI scan buffer content  in a different post that you may check here - https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xqls-for-powershell-script-logging/td-p/... 

Hope that was helpful, and if it answers your question please feel free to mark this as a solution so others can benefit from.

Thanks 
Z