Executions
On this page
Executions answers: what ran on the host, and how was it abused?
At a glance
Question | What ran on the host, and how was it abused? |
Reads | Process creations, the processes running now, program runs, PowerShell's records, WMI and WinRM's records. |
Works best with | Process Creation auditing with command lines, PowerShell Script Block Logging, Sysmon. |
Rule prefix |
|
What it reads
Source | Evidence | What it adds |
|---|---|---|
Security log 4688; Sysmon event 1 |
| Every process start, with its parent, account, elevation and - when recorded - command line. Sysmon adds hashes. A process both record is one signal. |
The live process table |
| What is running now, with its command line and account. |
Prefetch, BAM, DAM, the PCA launch list |
| Programs that ran, even when no log recorded them - without command line or parent. |
PowerShell 4104, 4103; Windows PowerShell 800, 400 |
| What PowerShell ran, block by block, and engine starts with the command line that started them. |
Every profile's PowerShell history; transcripts |
| Commands typed at a prompt - even when no log recorded them. |
WMI-Activity 5857, 5858, 5860; WinRM 6, 91 |
| WMI providers loaded, failed operations, temporary subscriptions; remote sessions in and out. |
Signals it raises
29 rules: 17 high, 8 medium, 4 low. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| high | A script that tampers with the Antimalware Scan Interface |
|
|
| high | A command to delete Windows backups or their catalog |
|
|
| high | A PowerShell command that decodes text and runs it as code |
|
|
| high | A PowerShell command that downloads code and runs it |
|
|
| high | A command to save the SAM, SECURITY or SYSTEM registry hive to a file |
|
|
| high | LSASS memory was dumped, or a command tried to |
|
|
| high | An Office application spawned a shell or scripting engine |
|
|
| high | A command to turn off or erase PowerShell's command history |
|
|
| high | PowerShell text written to be unreadable |
|
|
| high | A command to turn off Windows recovery |
|
|
| high | A PowerShell command that loads a program from decoded bytes |
|
|
| high | A WMI subscription's script ran |
|
|
| high | A command to delete volume shadow copies |
|
|
| high | A command to resize shadow copy storage to almost nothing |
|
|
| high | A living-off-the-land binary ran with a known-abuse pattern |
|
|
| high | A Windows system process name ran from the wrong folder |
|
|
| high | A PowerShell command that starts a process on another host through WMI |
|
|
| medium | A COM object started a shell or scripting engine |
|
|
| medium | PowerShell ran with an encoded command |
|
|
| medium | PowerShell 2.0 was started |
|
|
| medium | PowerShell text that looks written to be unreadable |
|
|
| medium | A PowerShell command that starts a process through WMI |
|
|
| medium | WMI loaded a provider from an unusual folder |
|
|
| medium | A WMI client worked with script or command consumers |
|
|
| medium | WMI started a shell or scripting engine |
|
|
| low | A process ran from a suspicious location |
| - |
| low | A remote shell was opened on this host through WinRM |
|
|
| low | This host opened WinRM sessions to another host |
|
|
| low | Another computer used WMI on this host |
|
|
How to read it
Telemetry first. Process Creation auditing on, Command lines recorded, PowerShell Script Block Logging on: when these are off, most rules are
not_run. Prefetch on and Program runs read tell you whether the fallback sources were there.A process creation is historical. It proves a process started; check
enrichment.process.still_runningand its exit (when Process Termination auditing is on).A program run is weaker. Prefetch, BAM and PCA say a program ran, not how or with what arguments. Paths from Prefetch and PCA may be in upper case.
History lines have a range. A command in a history file was typed between the file's creation and its last write.
Commands are titled by the command, not its outcome. A command line does not prove the command succeeded.
What it can't see
Try it yourself
-
Turn on command lines
In an elevated prompt:
auditpol /set /subcategory:"Process Creation" /success:enableand set the policy Include command line in process creation events (Computer Configuration, Administrative Templates, System, Audit Process Creation). -
Do something a rule looks for, harmlessly
Run
powershell -enc VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAGgAaQAiAA==- it only prints "hi", but it is an encoded command. -
Run Executions
signal live -m Executions -o .\and find EXEC-ENCODED-POWERSHELL (medium): its signal names your command line, your account and its parent. Decode the text yourself to see that it is harmless - in real cases, that is your next step.
Next
Persistence: what will run again.