Process Hunting - Powershell + WGET typing manualy

[Cyber1985]

Hello dear community, 

is there a way to hunt for a manually started powershell.exe where a attacker started wget. 

In this case I opened cmd and typed this CMD in. Cortex XDR recognized it. 

But when I manualy open powershell and type in manualy wget google.at Cortex XDR doesn't recognize the parameters in the powershell with my query. 

What is the best way to track starting wget in powershell? 

BR

Rob

[afurze · Accepted solution]

Hi Cyber1985,

There's some Windows nuance happening here which is tripping you up.  When you used CMD to launch Powershell, Cortex examined the command line arguments passed to powershell (i.e. powershell.exe wget [site_url]) and was able to match "wget", however, when you type "wget" into an interactive Powershell window, there are no command line arguments to examine, it all happens within the interactive shell without spawning a subprocess as was the case with CMD.

To detect this, you will need to have Powershell logging enabled shown here from Microsoft, https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_win...

Assuming you have Cortex XDR Pro per Endpoint, Windows Event logs are ingested and can be searched.

[Cyber1985]

Hey Afurze, 

nice nickname, is it german? 

I tested it and it worked on my machine. So, we will need to activate the PowerShell logging on every domain. 

Thanks a lot! 

BR

Rob

[NathanBradley]

is there a list of windows event logs thats are collected? i was not aware powershell event logs are available in cortex

[afurze]

Here is the article which outlines what Windows Event Logs are collected by Cortex.