Source
r/crowdstrike•
gregolde

Threat Hunting Invoke-Webrequest Powershell possible?

Query Help

I've been testing detection of powershell processes after getting a start with the related CQF that was previously posted. I'm struggling to find the full command line value when running invoke-webrequest from a powershell window spawned by the user. The event data just returns "powershell.exe" in the command line field instead of what was entered like "invoke-webrequest http://somesite.com/virus.txt -output virus.txt"

Is there something I'm missing, or is the command line value not supposed to return this type of info when powershell commands are executed in an interactive powershell instance?

Posted Aug 25, 2021, 12:18 PM UTC

113
blahdidbert•

Can you share the SPL you are working with? I think it might be a simple tweak.

1
gregoldeOP•

Thanks, I've got my query as simple as I can make it just to continue exploring the fields. I have a test machine that I've been working with, and I've just been looking at all of the CommandLine results for powershell.exe on that host and running stats to see what's up:

event_platform=win event_simpleName=ProcessRollup2 
FileName=powershell.exe ComputerName=WORKSTATION2
| stats c by CommandLine

The result of that is literally just:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

I just did some searching for the file I downloaded, and I do see some results in the CommandHistory field, so I guess I need to see if I can marry CommandHistory to CommandLine.

1
Andrew-CSCS ENGINEER•

Hi there. You're not missing anything as that will not be in the command line since it's run through the PowerShell interpolator. To get the basic data, please try this:

event_platform=win event_simpleName IN (ScriptControl*)
| search invoke-webrequest 
| table ContextTimeStamp_decimal aid ComputerName event_simpleName ScriptContent 
| convert ctime(ContextTimeStamp_decimal)
1
gregoldeOP•

Hey Andrew,

That doesn't return any results. I only see results when searching CommandHistory:

https://imgur.com/qmK3KwU

I tried multiple times, and then ran an LS to see the files were created, so the data is there, just not sure what I'm missing.

1
Andrew-CSCS ENGINEER•

Got it. Try this:

event_platform=win event_simpleName IN (CommandHistory, ScriptControl*) 
| eval runDetails=coalesce(CommandHistory, ScriptContent) 
| search runDetails=invoke-webrequest 
| table _time aid ComputerName event_simpleName runDetails

That should cover both scenarios.

In the applicable prevention policy, under the "Enhanced Visibility" section, make sure the following are enabled:

  • Interpreter-Only
  • Script-Based Execution Monitoring
1
gregoldeOP•

Still striking out, no results. I also confirmed that both Interpreter-Only and Script-Based Execution Monitoring were already enabled. I opened a support ticket yesterday but haven't heard anything on it yet.

1
[deleted]•

[deleted]

1
Andrew-CSCS ENGINEER•

Hi there. What are you expecting to see? If I run the following:

powershell -exec bypass invoke-webrequest http://cinsscore.com/list/ci-badguys.txt -OutFile filename.txt

Falcon will capture all the requisite events: https://imgur.com/a/R78aSLs

If the execution flow is different: launch cmd.exe; type powershell; from PS command prompt run invoke-webrequest...

The output will look different since the execution flow is different: https://imgur.com/a/T1R0eoP

What script contents are you expecting to see? The file located at the URL above does not contain a script. It contains a list of IP addresses.

Need a little more information to help out.

1