Troubleshooting Pack Cmdlet Execution

Title: Troubleshooting Pack Cmdlet Execution
Status: test
Description:Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS)
References:
  -https://twitter.com/nas_bench/status/1537919885031772161
  -https://lolbas-project.github.io/lolbas/Binaries/Msdt/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-21
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1202'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'Invoke-TroubleshootingPack'
      -'C:\Windows\Diagnostics\System\PCW'
      -'-AnswerFile'
      -'-Unattended'

  condition:selection
Falsepositives:
  -Legitimate usage of "TroubleshootingPack" cmdlet for troubleshooting purposes
Level: medium