In the next section,
we'll be looking at scripted attacks in the example of Windows PowerShell.
Attacks are almost always scripted,
allowing the attacker to thoroughly test beforehand and to
execute with a minimum time to keep a low profile.
Scripts are nearly always obfuscated in some way to try to avoid detection.
PowerShell on Windows, like Bash on Linux,
is a universal and powerful scripting language that can be
used to easily change system configuration.
In the demonstration, we'll cover the following,
detecting malicious PowerShell scripts with command line inspection,
identifying the script in the context that it was invoked
using msticpy's proces tree viewer,
and deciphering and understanding the script purpose.
The attack data used in this demo comes from a fantastic
resource built by the Open Threat Research Forge.
Security Datasets is a repository of event logs and documentation that
demonstrates one or more of the MITRE techniques.
Countless hours of work have gone into building and
maintaining this for the community, and we're really grateful to have it.
Picking up the story from the end of the previous demo,
let's assume that we've identified one or more hosts that
communicated with one of our attacker IP addresses.
We're going to look at one of those hosts to investigate if
anything suspicious occurred on that machine.
Let's query some process events from a suspected compromised host used
in msticpy's data providers and the built‑in query,
list_host_processes.
So how do we find suspicious PowerShell script events?
Sometimes, simple approaches can work.
Malicious scripts are often concatenated into long command lines
that can be detectable just by their size.
Searching for process executions with unusually long
command lines can sometimes reveal an attack.
A simple way of visualizing this is to use a histogram.
Pandas can plot histograms natively.
We just need to give it the right data to work on.
A histogram plots the number of items found matching a given range of values.
You need to tell the histogram how many ranges,
referred to as bins, to split the values into.
Here, we want to use Commandline Length in our histogram.
We can calculate this by taking the CommandLine column from our
process events and using the pandas str.len function.
This calculates the length of each command line.
Then we pass it to one of the pandas plot functions, hist.
The parameters to hist are log=True to make the y‑scale
logarithmic and bins which tells pandas to divide the
events into 100 separate ranges.
The first range will show all events with the Commandline
Lengths of something like 0 to 50 characters,
the second, 50 to 100, and so on.
The other parameters specify the size of the plot and the title.
The reason we specified our log plot is because the events with
shorter command lines number in the thousands,
and so it would make our rare processes with long command
lines almost invisible on the plot.
From this plot,
we can see 2 unusually long command lines of just over 2000 and 5000 characters.
Looking at those events, one appears to be a benign, if verbose, GoogleUpdate.
The other one is a PowerShell event with a parameter
that looks like an encoded string.
Before we return to this event though,
let's look at a couple of other approaches.
We might reasonably think about searching for
scripting executables such as PowerShell,
cscript, and wscript; however, many benign processes use these technologies,
so it usually doesn't help narrow our search very well.
You can see here that we have nearly 1300 PowerShell executions in our dataset.