XQLs for powershell script logging?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XQLs for powershell script logging?

L4 Transporter

Hello dear community, 

 

has anyone of you some usefull powershell script block XQLs for event logs to share them with us?

 

BR

Rob

 

 

1 REPLY 1

L2 Linker

@RFeyertag 
Hi Rob-

 

If i understood your request correctly, we can utilize the deeper inspection mechanism that is built-in for scripting services in windows that is part of the Antimalware Scan Interface (AMSI).
In that, we can look at the content of the Antimalware Scan Interface (AMSI) buffer (AmsiScanBuffer ) and retrieve the information we are looking for , either from the event log message or form the event log data fields itself , where we can get information such as (a snippet from a lab environment below):

{
"appname": "VBScript",
"session": "0x0",
"content": "IHost.CreateObject(\"WScript.Shell\");\r\nIWshShell3.Run(\"C:\\xampp\\htdocs\\update.bat\", \"0\", \"true\");\r\n",
"scanStatus": "0",
"contentname": "C:\\xampp\\htdocs\\vb.vbs",
"scanResult": "1",
"originalsize": "196",
"contentsize": "196",
"hash": "0xB3D07F9F1DDFD9C26EB15A41DB734BA380360F5577015B0C70CC9858849DB8FD",
"contentFiltered": "false",
"hashoriginalcontent": "0x0000000000000000000000000000000000000000000000000000000000000000"
}

Now, for us to extract those information form the "string represented in JSON" filed or from he event log message we can use some extraction techniques provided by XQL , i will referee you to a detailed webinar we had that goes over the extraction for the event log messages in both cases ( Webinar Link in case you would like to get more information in this regard - https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-advance...) .

Back to your question about a query that can return these results, we can use the below one:
Config case_sensitive = false
| dataset = xdr_data // or you can use perset = preset = xdr_event_log
| filter event_type = EVENT_LOG and action_evtlog_message = "AmsiScanBuffer"
| alter app_name = json_extract_scalar(action_evtlog_data_fields, "$.appname")
| alter content = json_extract_scalar(action_evtlog_data_fields, "$.content")
| alter content_name = json_extract_scalar(action_evtlog_data_fields, "$.contentname")
| fields agent_hostname, content, content_name, app_name, action_evtlog_data_fields, action_evtlog_message ,actor_effective_username, actor_process_image_path, actor_process_command_line
| sort desc _time

Additional filtering can be added to the "content" field depending on the use case you are trying to achieve.

Please give this a try and let me know if it helps

Thanks!
Z




Z
  • 1023 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!