Cortex XDR missing powershell logging

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex XDR missing powershell logging

L0 Member

I'm doing some Powershell detection testing and I noticed that when I open the Powershell GUI in windows and run a command below it doesn't trigger a Powershell detection.  However, when I add powershell in front of the command it does trigger an event. I'm pretty sure this always wasn't the case.  Curios to see if this is expected behavior or something is broken with XDR. 

 

Start-BitsTransfer -Priority foreground -Source https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md -Destination c:\source\flag.ps1

 

 

3 REPLIES 3

L4 Transporter

Hi @Vadim_Lisserman 

Do you have XDR pro license, and if you have it, its enable in the agents?

PCSPI, PCNSCx3,PCNSEx4,, PCSAE,PCDRA, ISC2 CC

L0 Member

Yes, and yes.  Have you tried this in your environment are you seeing different results?

L2 Linker

Hi @Vadim_Lisserman 

 

This has more to do with what was your action process vs what was the actor process, in the case where PowerShell is doing the click action/ acting it is called the actor process , and when PowerShell is being spawned by another process that calls PowerShell it is called the action process, and hence, the detection is dependent on the action process in this case, while not all detection have he same criteria but this is in your use case.

You can create custom detection as well, by utilizing the correlation rule, and in order for you to find the inspected script executed by PowerShell, you can utilize the AMSI scan buffer, that sits between the scripting engine, in our case PowerShell, and the XDR.

 

zarnous_0-1709245598288.png

 


I have also went over this and how to look at the AMSI scan buffer content  in a different post that you may check here - https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xqls-for-powershell-script-logging/td-p/... 

Hope that was helpful, and if it answers your question please feel free to mark this as a solution so others can benefit from.

Thanks 
Z

Z
  • 1107 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!