Will the Rule Builder accept Powershell commands?

[Chris_Dietz]

Will the process rule builder accept Powershell commands? or only Windows command line?

[bbucao · Accepted solution]

Hi Chris_Dietz,

Yes, the CMD field in the BIOC rule builder applies to any process command line captured by the XDR agent, including powershell. You can narrow your rule down further by defining powershell.exe as the process name in the rule builder as well. 

Thanks,
Ben

[Chris_Dietz]

Thanks Ben! What do I do if I have a multiple line command? Do I just paste it all in there?

[bbucao]

Hi Chris_Dietz,

I may have misunderstood your original question. The logic you use to match the traffic will depend on how it was executed. If a command prompt is used to execute powershell commands such as powershell.exe Write-Host "Hello, World!", You could use the process rule builder to match on the command line.  If the command/commands were executed through a powershell terminal you can try using the query below as a template to create rules off of. You can add any number of filtering criteria on the "content" field which should result in matches on your identified powershell activity. I do recommend running some test powershell commands and validating that you can match on it using a variation of the below query, which is valid to save as a BIOC rule.

dataset = xdr_data
| filter event_type = EVENT_LOG and action_evtlog_message = "AmsiScanBuffer "
| alter content = json_extract_scalar(action_evtlog_data_fields, "$.content")
|filter actor_process_image_path contains "powershell"
//| filter content contains "Write-Host Hello, World" 


Thanks,
Ben

[Chris_Dietz]

Hi Ben,

I'm trying to take some of the Red Canary tests and add the criteria to Cortex. Here is a link to what I'm looking at to give you an idea.

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md