Update PowerShell parameter aliases #3591

sventec · 2025-07-03T23:57:38Z

Details

This PR consists of some batch updates to PowerShell activity-based detections that include parameters in the detection logic for which a parameter alias exists.

The commands, and parameter aliases for said commands, that were looked at for this PR are as follows (links to relevant docs for aliases):

The purpose of these updates is to ensure the desired activity is captured by the detection, regardless of whether a parameter name or alias is used, for any parameters which have an alias.

The changes were made with minimum # LOC modified in mind, but happy to adjust formatting to whatever best practice is for the repo. Opted not to reflow any search blocks with long lines as a result of the added logic, but it'd be easy to adjust if that's the desired process. I additionally attempted to maintain consistent style with whichever individual detection was being modified, with minimum modification/potential disruption in mind, but would again be happy to refactor into more repeatable logic (e.g., a macro or two to replace components that are repeated across detections).

I'm unsure if this PR covers the exhaustive list of PowerShell-activity based detections with potential parameter alias visibility gaps, but I plan to keep searching/parsing some more in an attempt to surface any others.

Detections updated:

endpoint/getwmiobject_ds_computer_with_powershell
endpoint/getwmiobject_ds_computer_with_powershell_script_block
endpoint/getwmiobject_ds_group_with_powershell
endpoint/getwmiobject_ds_group_with_powershell_script_block
endpoint/getwmiobject_ds_user_with_powershell
endpoint/getwmiobject_ds_user_with_powershell_script_block
endpoint/interactive_session_on_remote_endpoint_with_powershell
endpoint/remote_process_instantiation_via_winrm_and_powershell
endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block
endpoint/remote_process_instantiation_via_wmi_and_powershell

Checklist

Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
CI/CD jobs passed ✔️
Validated SPL logic.
Validated tags, description, and how to implement.
Verified references match analytic.
Confirm updates to lookups are handled properly.

Notes For Submitters and Reviewers

If you're submitting a PR from a fork, ensuring the box to allow updates from maintainers is checked will help speed up the process of getting it merged.
Checking the output of the build CI job when it fails will likely show an error about what is failing. You may have a very descriptive error of the specific field(s) in the specific file(s) that is causing an issue. In some cases, its also possible there is an issue with the YAML. Many of these can be caught with the pre-commit hooks if you set them up. These errors will be less descriptive as to what exactly is wrong, but will give you a column and row position in a specific file where the YAML processing breaks. If you're having trouble with this, feel free to add a comment to your PR tagging one of the maintainers and we'll be happy to help troubleshoot it.
Updates to existing lookup files can be tricky, because of how Splunk handles application updates and the differences between existing lookup files being updated vs new lookups. You can read more here but the short version is that any changes to lookup files need to bump the the date and version in the associated YAML file.

Adds parameter aliases to detections with logic that matches parameters for Get-WmiObject. Alias reference: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1#parameters

Add the full parameter '-ComputerName' to the detection logic, which was previously matching only the parameter alias '-CN'. This aligns the detection with others in the ESCU that look for suspicious Invoke-WmiMethod activitiy.

Adds '-ComputerName' parameter alias '-Cn' to logic for detections that look for Invoke-Command activity.

Adds '-Cn' alias of parameter '-ComputerName' to logic for interactive_session_on_remote_endpoint_with_powershell detection. Alias reference: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.5#parameters

nasbench · 2025-07-07T09:30:51Z

detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml

@@ -16,7 +16,7 @@ description: The following analytic detects the execution of the `Get-WmiObject`
 data_source:
 - Powershell Script Block Logging 4104
 search: '`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText
-  = "*ds_user*" ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*"
+  = "*ds_user*" (ScriptBlockText = "*-namespace*" OR ScriptBlockText = "*-ns*") ScriptBlockText = "*root\\directory\\ldap*"


This one is too short of an atom to be used in a ScriptBlock on its own. Hence I dont recommend using it.

nasbench · 2025-07-07T09:36:02Z

detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml

@@ -17,7 +17,7 @@ description:
 data_source:
  - Powershell Script Block Logging 4104
 search:
-  '`powershell` EventCode=4104 (ScriptBlockText="*Enter-PSSession*" AND ScriptBlockText="*-ComputerName*")
+  '`powershell` EventCode=4104 (ScriptBlockText="*Enter-PSSession*" AND (ScriptBlockText="*-ComputerName*" OR ScriptBlockText="*-Cn*"))


While the logic could see some improvements. Adding -Cn is similar to my comment above.
It a short atom that could match with other things in the script. I would not recommend adding directly as it is.

If you would like to add it, I would suggest you enhance the logic of the rule overall. By focusing on the -ComputerName flag and its alias as arguments in the same line.

While this might introduce some bypass edge case. It would be far more accurate to the intent of the rule (which is remote endpoint) and less FP prone.

nasbench · 2025-07-07T09:37:39Z

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml

@@ -19,7 +19,7 @@ data_source:
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-Command*"
-  AND Processes.process="*-ComputerName*") by Processes.action Processes.dest Processes.original_file_name
+  AND (Processes.process="*-ComputerName*" OR Processes.process="*-Cn*")) by Processes.action Processes.dest Processes.original_file_name


Adding a space to avoid any rare edge cases.

Suggested change

AND (Processes.process="*-ComputerName*" OR Processes.process="*-Cn*")) by Processes.action Processes.dest Processes.original_file_name

AND (Processes.process="*-ComputerName*" OR Processes.process="*-Cn *")) by Processes.action Processes.dest Processes.original_file_name

nasbench · 2025-07-07T09:37:54Z

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml

@@ -16,7 +16,7 @@ description:
 data_source:
  - Powershell Script Block Logging 4104
 search:
-  '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-Command*" AND ScriptBlockText="*-ComputerName*")
+  '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-Command*" AND (ScriptBlockText="*-ComputerName*" OR ScriptBlockText="*-Cn*"))


See my comments above.

nasbench · 2025-07-07T09:38:09Z

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml

@@ -18,7 +18,7 @@ data_source:
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-WmiMethod*"
-  AND Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND  Processes.process="*-Name
+  AND (Processes.process="*-CN*" OR Processes.process="*-ComputerName*") AND Processes.process="*-Class Win32_Process*" AND  Processes.process="*-Name


Suggested change

AND (Processes.process="*-CN*" OR Processes.process="*-ComputerName*") AND Processes.process="*-Class Win32_Process*" AND Processes.process="*-Name

AND (Processes.process="*-Cn *" OR Processes.process="*-ComputerName*") AND Processes.process="*-Class Win32_Process*" AND Processes.process="*-Name

sventec added 4 commits July 3, 2025 17:09

fix(get-wmiobject): add parameter aliases

48986aa

Adds parameter aliases to detections with logic that matches parameters for Get-WmiObject. Alias reference: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1#parameters

fix(invoke-wmimethod): add parameter name

825c52c

Add the full parameter '-ComputerName' to the detection logic, which was previously matching only the parameter alias '-CN'. This aligns the detection with others in the ESCU that look for suspicious Invoke-WmiMethod activitiy.

fix(invoke-command): add parameter alias

9f65efe

Adds '-ComputerName' parameter alias '-Cn' to logic for detections that look for Invoke-Command activity.

sventec requested review from patel-bhavin and ljstella as code owners July 3, 2025 23:57

github-actions bot added the Detections label Jul 3, 2025

nasbench requested changes Jul 7, 2025

View reviewed changes

nasbench added the WIP DO NOT MERGE Work in Progress label Jul 7, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update PowerShell parameter aliases #3591

Update PowerShell parameter aliases #3591

Uh oh!

sventec commented Jul 3, 2025

Uh oh!

nasbench Jul 7, 2025

Uh oh!

nasbench Jul 7, 2025

Uh oh!

nasbench Jul 7, 2025

Uh oh!

nasbench Jul 7, 2025

Uh oh!

nasbench Jul 7, 2025

Uh oh!

Uh oh!

	AND (Processes.process="-ComputerName" OR Processes.process="-Cn")) by Processes.action Processes.dest Processes.original_file_name
	AND (Processes.process="-ComputerName" OR Processes.process="-Cn ")) by Processes.action Processes.dest Processes.original_file_name

	AND (Processes.process="-CN" OR Processes.process="-ComputerName") AND Processes.process="-Class Win32_Process" AND Processes.process="*-Name
	AND (Processes.process="-Cn " OR Processes.process="-ComputerName") AND Processes.process="-Class Win32_Process" AND Processes.process="*-Name

Update PowerShell parameter aliases #3591

Are you sure you want to change the base?

Update PowerShell parameter aliases #3591

Uh oh!

Conversation

sventec commented Jul 3, 2025

Details

Checklist

Notes For Submitters and Reviewers

Uh oh!

nasbench Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

nasbench Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

nasbench Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

nasbench Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

nasbench Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!