PowerShell Scripts Installed as Services - Security

Title: PowerShell Scripts Installed as Services - Security
Status: test
Description:Detects powershell script installed as a Service
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Author: oscd.community, Natalia Shornikova
Date: 2020-10-06
modified:2022-11-29
Tags:

• -'attack.execution'
• -'attack.t1569.002'

Logsource:

• product: windows
• service: security
• definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697

Detection:
  selection:
    EventID: '4697'
    ServiceFileName|contains:
      -'powershell'
      -'pwsh'

  condition:selection
Falsepositives:
  -Unknown
Level: high