Detect and Restrict Powershell cmdlets

[agirones]

Hello everyone,

I would like to know if any of you have struggled with support and technical cases with the need I show below.

I would like to know what you can tell me or give me your opinion about taking action against powershell cmdlets.

After several cases and meetings with support, I can't get a solid answer to my needs about restricting some powershell cmdlets.

I hope to find a solution that fits my needs, thanks anyway.

[jmazzeo]

Hi @agirones, thanks for reaching us using the Live Community.

Can you share more information about what cmdlets you are trying to detect or block? Do you have some example?

Maybe I can do some test in my lab and try to help you.

[agirones]

Hi @jmazzeo, thaks for your interest and trying to help!

Example, I want to restrict cmdlet like:

Set-ItemProperty -Path
Remove-ItemProperty -Path
Invoke-AADintReconAsOutsider
Remove-DomainObjectACL

[jmazzeo · Accepted solution]

Hi @agirones, I believe that this could work for you.

• Create a new custom BIOC rule going to Detection Rules - BIOC
• Select the Event Log type. The powershell cmdlets details are taken from the windows event log.
• Set a name, and put all the required commands in the "Message" field in this format:

*Set-ItemProperty -Path*|*Remove-ItemProperty -Path*|*Invoke-AADintReconAsOutsider*|*Remove-DomainObjectACL*

Use the "|" character as an OR separator, and the "*" as wildcard.

• Before save it you can test it to check if you have some matching events. 
• You will see the  command details by opening the "View event log message" from the results.
  
• This is how you will see the details:
  
• Alerts generated:
  

This works for cmdlets running in a live powershell console in the host, and it will also detect this commands running from scripts.

The "Event log" type BIOC Rules can't be used to block, only for notifications.

If this post answers your question, please mark it as the solution.

[agirones]

Hey @jmazzeo, 

Thanks, I know this detection functionality, together with an automation with "terminate casuality chain" that kills the powershell process can be a "solution".

This feature requires XTH - Xtended Threat Hunting license (which I don't have).

The only drawback I see to this solution is that it is an asynchronous solution (it works after executing the command, in this case the cmdlet).