Detection: Powershell Execute COM Object

Description

The following analytic detects the execution of a COM CLSID through PowerShell. It leverages EventCode 4104 and searches for specific script block text indicating the creation of a COM object. This activity is significant as it is commonly used by adversaries and malware, such as the Conti ransomware, to execute commands, potentially for privilege escalation or bypassing User Account Control (UAC). If confirmed malicious, this technique could allow attackers to gain elevated privileges or persist within the environment, posing a significant security risk.

Search

1`powershell` EventCode=4104 ScriptBlockText = "*CreateInstance([type]::GetTypeFromCLSID*" 
2| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
3| rename Computer as dest 
4| rename UserID as user 
5| `security_content_ctime(firstTime)` 
6| `security_content_ctime(lastTime)` 
7| `powershell_execute_com_object_filter`

Data Source

Name	Platform	Sourcetype	Source
Powershell Script Block Logging 4104	Windows	'xmlwineventlog'	'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Known False Positives

network operrator may use this command.

Associated Analytic Story

• Data Destruction

• Hermetic Wiper

• Malicious PowerShell

• Ransomware

Risk Based Analytics (RBA)

References

• https://threadreaderapp.com/thread/1423361119926816776.html

• https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 4