Detection: Windows Software Discovery Via PowerShell

Description

Detects the use of PowerShell based registry queries to pull installed software information from the Uninstall key. This will give an attacker version information on installed software which could be used to identify further vulnerabilities. False positives are unlikely as this is an unusual key to query with PowerShell.

Search

 1`powershell`
 2EventID="4104"
 3ScriptBlockText="*Get-ItemProperty *"
 4ScriptBlockText="*Windows\\CurrentVersion\\Uninstall*"
 5
 6| fillnull
 7
 8| stats count min(_time) as firstTime
 9              max(_time) as lastTime
10  by Computer EventID ScriptBlockText signature signature_id user_id vendor_product Guid
11     Opcode Name Path ProcessID ScriptBlockId
12
13
14| rename Computer as dest
15
16| `security_content_ctime(firstTime)`
17
18| `security_content_ctime(lastTime)`
19
20| `windows_software_discovery_via_powershell_filter`

Data Source

Name	Platform	Sourcetype	Source
Powershell Script Block Logging 4104	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.

Known False Positives

Legitimate system administrators or security tools may query the Uninstall key via PowerShell for software inventory or compliance checks. Filter as needed to allow authorized management scripts.

Associated Analytic Story

• Windows Discovery Techniques

Risk Based Analytics (RBA)

Risk Message:

Potential software discovery via PowerShell observed on $dest$ via script block $ScriptBlockId$.

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1