{"id":"af4c87ce-bdda-4215-b998-15220772e993","title":"Suspicious Process Discovery With Get-Process","description":"Get the processes that are running on the local computer.","author":"frack113","status":"test","level":"low","date":"2022-03-17","modified":"","tags":["attack.discovery","attack.t1057"],"technique_ids":["T1057"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Legitimate PowerShell scripts"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-3---process-discovery---get-process","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7.4"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml","source_sha256":"fc05a6f8d01b1e8c2da3c6947ade2f1bb7570f96f0c62e123e7d9c7353bf0a3c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Process Discovery With Get-Process\nid: af4c87ce-bdda-4215-b998-15220772e993\nstatus: test\ndescription: Get the processes that are running on the local computer.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-3---process-discovery---get-process\n    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7.4\nauthor: frack113\ndate: 2022-03-17\ntags:\n    - attack.discovery\n    - attack.t1057\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains: Get-Process\n    condition: selection\nfalsepositives:\n    - Legitimate PowerShell scripts\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1057","id":"T1057","name":"Process Discovery","page":"techniques/enterprise/T1057/"}],"data_path":"data/detection-rules/af4c87ce-bdda-4215-b998-15220772e993.json","kind":"sigma"}