Modern versions of Windows will have PowerShell installed by default.
In this clip,
I will talk about configuring Winlogbeat to collect
PowerShell logs that will provide defenders with the event
data necessary to detect anomalies.
PowerShell is a robust command shell and scripting
language used by system administrators for various
automation and remote management tasks.
Adversaries understand the capabilities of PowerShell and
will use it to enable their objectives.
For example, threat intelligence reports from FireEye,
CrowdStrike,
and Microsoft show that malware has been seen using
PowerShell to evade detection, download remote code,
and make system configuration changes, among many other things.
Let's look at an example.
The PowerShell command you see on the screen will attempt to bypass
any configured execution policy and then execute the command or
commands obscured by the Base64 encoding.
Sometimes, there could be additional layers of encoding or encryption,
so copying and pasting the payload into a decoder won't get us the details.
If you see something like this in your environment,
it's a good chance it will be anomalous.
If your organization has an operational need to encode PowerShell commands,
then that should be well defined and documented so the
security team can account for it.
As defenders,
we can use Winlogbeat to help us aggregate the PowerShell
logs from across the enterprise into a central platform for
threat hunting and analysis.
In the Winlogbeat configuration, you will need to enable event ID 4103 and 4104.
Together,
these event IDs can show the encoded and decoded PowerShell commands
and the entire contents of PowerShell scripts.
In some cases, the output from malicious PowerShell execution is also logged.
Another event ID we should employ is 4688, which I covered in a
previous clip. Enabling this event ID will allow Winlogbeat to
capture and ship process creation events generated by PowerShell
and the command line.
It's not enough just to put the event IDs in the configuration file, you will
have to enable these event IDs using Group Policy explicitly,
then remember to perform testing and tuning for your environment.