{"id":"b66474aa-bd92-4333-a16c-298155b120df","title":"Potential Persistence Via Powershell Search Order Hijacking - Task","description":"Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader","author":"pH-T (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-08","modified":"2023-02-03","tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001"],"technique_ids":["T1053.005","T1059.001"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/"],"source_path":"rules/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml","source_sha256":"3be1832f83464fb355313ff9918027caaef29baf8ed79e8bf2711b2b40249f50","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Persistence Via Powershell Search Order Hijacking - Task\nid: b66474aa-bd92-4333-a16c-298155b120df\nrelated:\n    - id: 6e8811ee-90ba-441e-8486-5653e68b2299\n      type: similar\nstatus: test\ndescription: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader\nreferences:\n    - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/\nauthor: pH-T (Nextron Systems), Florian Roth (Nextron Systems)\ndate: 2022-04-08\nmodified: 2023-02-03\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.persistence\n    - attack.t1053.005\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage: 'C:\\WINDOWS\\System32\\svchost.exe'\n        ParentCommandLine|contains|all:\n            - '-k netsvcs'\n            - '-s Schedule'\n        CommandLine|endswith:\n            - ' -windowstyle hidden'\n            - ' -w hidden'\n            - ' -ep bypass'\n            - ' -noni'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/b66474aa-bd92-4333-a16c-298155b120df.json","kind":"sigma"}