Try in Splunk Security Cloud
Description
- Type: TTP
Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Last Updated: 2024-05-21
- Author: Michael Haag, Splunk
- ID: ea61e291-af05-4716-932a-67faddb6ae6f
Annotations
ATT&CK
ATT&CK
| ID | Technique | Tactic |
|---|---|---|
| T1546.015 | Component Object Model Hijacking | Privilege Escalation, Persistence |
| T1059 | Command and Scripting Interpreter | Execution |
Kill Chain Phase
- Exploitation
- Installation
NIST
- DE.CM
CIS20
- CIS 10
CVE
Search
1
2
3
4
5
`powershell` EventCode=4104 ScriptBlockText = "*Software\\Classes\\CLSID\\*\\InProcServer32*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `powershell_com_hijacking_inprocserver32_modification_filter`
Macros
Required fields
List of fields required to use this analytic.
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
How To Implement
Known False Positives
False positives will be present if any scripts are adding to inprocserver32. Filter as needed.
Associated Analytic Story
RBA
| Risk Score | Impact | Confidence | Message |
|---|---|---|---|
| 64.0 | 80 | 80 | A PowerShell script has been identified with InProcServer32 within the script code on $Computer$. |
Reference
Test Dataset
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Похожее:
Как развернуть сценарий power shell в active directory с использованием gpo 
Windows 10 1080P, 2K, 4K, 5K HD wallpapers free download | Wallpaper Flare 
«Изменение размера шрифта для устройств Nokia по сравнению с изменением общего масштаба шрифта приложения на Android с использованием Configuration.fontScale»? 
Хакерские рецепты