Potential Process Execution Proxy Via CL_Invocation.ps1

Title: Potential Process Execution Proxy Via CL_Invocation.ps1
Status: test
Description:Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"
References:
  -https://lolbas-project.github.io/lolbas/Scripts/Cl_invocation/
  -https://twitter.com/bohops/status/948061991012327424
Author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova
Date: 2020-10-14
modified:2023-08-17
Tags:

• -'attack.stealth'
• -'attack.t1216'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains: 'SyncInvoke '
  condition:selection
Falsepositives:
  -Unknown
Level: medium