Suspicious GetTypeFromCLSID ShellExecute

Title: Suspicious GetTypeFromCLSID ShellExecute
Status: test
Description:Detects suspicious Powershell code that execute COM Objects
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md#atomic-test-2---powershell-execute-com-object
Author: frack113
Date: 2022-04-02
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1546.015'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'::GetTypeFromCLSID('
      -'.ShellExecute('

  condition:selection
Falsepositives:
  -Legitimate PowerShell scripts
Level: medium