Detection: Detect Empire with PowerShell Script Block Logging

Description

The following analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze commands sent to PowerShell, specifically looking for patterns involving system.net.webclient and base64 encoding. This behavior is significant as it often represents initial stagers used by PowerShell-Empire, a known post-exploitation framework. If confirmed malicious, this activity could allow attackers to download and execute additional payloads, leading to potential code execution, data exfiltration, or further compromise of the affected system.

Search

 1`powershell` EventCode=4104  (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*)
 2  
 3| fillnull
 4  
 5| stats count min(_time) as firstTime max(_time) as lastTime
 6    BY dest signature signature_id
 7       user_id vendor_product EventID
 8       Guid Opcode Name
 9       Path ProcessID ScriptBlockId
10       ScriptBlockText
11  
12| `security_content_ctime(firstTime)`
13  
14| `security_content_ctime(lastTime)`
15  
16| `detect_empire_with_powershell_script_block_logging_filter`

Data Source

Name	Platform	Sourcetype	Source
Powershell Script Block Logging 4104	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.

Known False Positives

False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.

Associated Analytic Story

• Hellcat Ransomware

• Hermetic Wiper

• Data Destruction

• Malicious PowerShell

Finding

Intermediate Findings

References

• https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html

• https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/

• https://github.com/BC-SECURITY/Empire

• https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf

• https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63

• https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 14