mirror of
https://github.com/cert-orangecyberdefense/cti
synced 2026-06-08 22:47:22 +00:00
Mar-Pic
35 lines
1.1 KiB
YAML
35 lines
1.1 KiB
YAML
title: Potential AES-encrypted PowerShell patterns in CommandLine
|
|
id: 47be590d-4a9e-4ab1-b9f6-a332709c2100
|
|
status: stable
|
|
description: |
|
|
Detects suspicious execution of Powershell commands related to AES Encryption.
|
|
This could be an indicator of use of Powershell to decrypt additionnal payload as observed during Emmenhtal infection.
|
|
references: https://www.orangecyberdefense.com/global/blog/cert-news/emmenhtal-a-little-known-loader-distributing-commodity-infostealers-worldwide
|
|
author: Orange Cyberdefense - Florian SIMONET
|
|
date: 2024/08/09
|
|
tags:
|
|
- attack.execution
|
|
- attack.defense_evasion
|
|
- attack.t1059.001
|
|
- attack.t1140
|
|
- tlp.white
|
|
logsource:
|
|
product: windows
|
|
category: process_creation
|
|
detection:
|
|
selection_img:
|
|
Image|endswith:
|
|
- '\powershell.exe'
|
|
- '\pwsh.exe'
|
|
OriginalFileName:
|
|
- 'PowerShell.EXE'
|
|
- 'pwsh.dll'
|
|
selection_cmdline:
|
|
CommandLine|contains|all:
|
|
- 'System.Security.Cryptography.Aes'
|
|
- 'CreateDecryptor'
|
|
condition: all of selection_*
|
|
falsepositives:
|
|
- Unknown
|
|
level: medium
|