XQLs for powershell script logging?

[RFeyertag]

Hello dear community, 

has anyone of you some usefull powershell script block XQLs for event logs to share them with us?

BR

Rob

[zarnous]

@RFeyertag 
Hi Rob-

If i understood your request correctly, we can utilize the deeper inspection mechanism that is built-in for scripting services in windows that is part of the Antimalware Scan Interface (AMSI).
In that, we can look at the content of the Antimalware Scan Interface (AMSI) buffer (AmsiScanBuffer ) and retrieve the information we are looking for , either from the event log message or form the event log data fields itself , where we can get information such as (a snippet from a lab environment below):

{
"appname": "VBScript",
"session": "0x0",
"content": "IHost.CreateObject(\"WScript.Shell\");\r\nIWshShell3.Run(\"C:\\xampp\\htdocs\\update.bat\", \"0\", \"true\");\r\n",
"scanStatus": "0",
"contentname": "C:\\xampp\\htdocs\\vb.vbs",
"scanResult": "1",
"originalsize": "196",
"contentsize": "196",
"hash": "0xB3D07F9F1DDFD9C26EB15A41DB734BA380360F5577015B0C70CC9858849DB8FD",
"contentFiltered": "false",
"hashoriginalcontent": "0x0000000000000000000000000000000000000000000000000000000000000000"
}

Now, for us to extract those information form the "string represented in JSON" filed or from he event log message we can use some extraction techniques provided by XQL , i will referee you to a detailed webinar we had that goes over the extraction for the event log messages in both cases ( Webinar Link in case you would like to get more information in this regard - https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-advance...) .

Back to your question about a query that can return these results, we can use the below one:
Config case_sensitive = false
| dataset = xdr_data // or you can use perset = preset = xdr_event_log
| filter event_type = EVENT_LOG and action_evtlog_message = "AmsiScanBuffer"
| alter app_name = json_extract_scalar(action_evtlog_data_fields, "$.appname")
| alter content = json_extract_scalar(action_evtlog_data_fields, "$.content")
| alter content_name = json_extract_scalar(action_evtlog_data_fields, "$.contentname")
| fields agent_hostname, content, content_name, app_name, action_evtlog_data_fields, action_evtlog_message ,actor_effective_username, actor_process_image_path, actor_process_command_line
| sort desc _time

Additional filtering can be added to the "content" field depending on the use case you are trying to achieve.

Please give this a try and let me know if it helps

Thanks!
Z