---
title: Potential Volume Shadow Copy Deletion (Wiper Activity)
id: 8a7c8f92-1d3e-4b5a-9c6d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to delete Volume Shadow Copies via vssadmin or PowerShell, a common precursor to wiper malware or ransomware.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2023/10/25
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'delete shadows'
      - 'DeleteShadowStorage'
  condition: selection
falsepositives:
  - System administrators performing backup maintenance
level: high
---
title: Suspicious PowerShell Encoded Command
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the use of EncodedCommand in PowerShell, frequently used by threat actors to obfuscate malicious scripts.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2023/10/25
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:\    Image|endswith: '\powershell.exe'
    CommandLine|contains: '-Enc'
  condition: selection
falsepositives:
  - Legitimate software installation scripts
  - System management tools
level: medium
---
title: Suspicious Certutil Download
id: c2d3e4f5-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects certutil being used to download remote files, a technique often used for staging malware.
references:
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2023/10/25
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:\    Image|endswith: '\certutil.exe'
    CommandLine|contains: 'urlcache'
  condition: selection
falsepositives:
  - Rare administrative file retrieval
level: high

// Hunt for suspicious PowerShell activity often used in web shell attacks
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "Invoke-Expression" or ProcessCommandLine has "IEX"
| summarize count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName, ProcessCommandLine
| order by count_ desc


// Detect potential wiper precursor events (System file modification)
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("lsass.exe", "ntoskrnl.exe", "hal.dll")
| where InitiatingProcessFileName !in~ ("windows", "explorer.exe", "services.exe")
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName, FolderPath, ActionType

-- Hunt for Scheduled Tasks that run PowerShell with encoded arguments
SELECT Name, Action, Trigger, Command
FROM foreach(
  row=glob(globs='C:\Windows\System32\Tasks\**'),
  query={
    SELECT Name, parse_xml(data=read_file(filename=OSPath)).xpath(query="//Task/Actions/Exec/@Command") AS Command,
           parse_xml(data=read_file(filename=OSPath)).xpath(query="//Task/Actions/Exec/@Arguments") AS Arguments,
           OSPath
    FROM scope()
  }
)
WHERE Command =~ "powershell.exe" AND Arguments =~ "-Enc"


-- Hunt for recent creation of hidden files in System32 (common for webshells/droppers)
SELECT FullPath, Size, Mode.Bits, Mtime, Atime
FROM glob(globs='C:\Windows\System32\**', nosymlink=TRUE)
WHERE Mtime > now() - 48h
  AND Mode.Bits & 0x02 == 0  -- Hidden file flag

<#
.SYNOPSIS
    Audit Scheduled Tasks for suspicious execution patterns.
.DESCRIPTION
    This script scans the Task Scheduler for tasks running PowerShell with encoded commands or suspicious paths.
#>

Get-ScheduledTask | Where-Object {
    $_.State -eq 'Ready' -and $_.Actions.Execute -like '*powershell*'
} | ForEach-Object {
    $Action = $_.Actions.Execute
    $Arguments = $_.Actions.Arguments
    
    if ($Arguments -match '-Enc' -or $Arguments -match 'DownloadString') {
        Write-Host "[!] Suspicious Task Found: $($_.TaskName)" -ForegroundColor Red
        Write-Host "    Action: $Action $Arguments"
    }
}