Exploit Prevention, get source name of the script

[jmcg]

Hello,

I have created a Expert Rule that trigger a report event when a specific command line in powershell is called.

In this event I cannot find the source name of the script that executed the command.

Is there a way to locate the script that tryied to execute this command ?

[Former Member]

Hello,

Thank you for your post.

Could you share a screenshot of the issue that you are referring to so that we can suggest you further?

[jmcg]

Hello i'm not really sure what to share with you.

It's easy.

I have a custom Expert rule, which include *Powershell* and specific "commandline"

When i check report / block i do receive event but I just have the description of the commandline, the source has powershell, but not the source script.

How can I have the source script ?

[Daveb3d]

There isn't necessarily a script file.  It could be a command line argument or a command passed in the shell.   If you want to to see script file names that aren't passed in the command line,  you would have to create a rule that logs ps1 file read.  

Dave

[Former Member]

Hello Dave,

I understand but if you could provide us a screenshot it will very helpful to suggest you further.

[jmcg]

Hm could you give me more detail on that?

[Daveb3d]

ENS doesn't log the script content. It would be necessary to use MVISION EDR on an AMSI-enabled system, using the ProcessHistory content collector to pull back script content, or enable local PowerShell logging and view the data there.

Dave

[jmcg]

Nice idea,

But even in ProcessHistory (using MAR search) I do not have the script Path, I only see the powershell.exe using the commandline without the source script.

[Daveb3d]

Depending upon the command line, there may be no script file at all.  You do not need a file to execute a PowerShell command.  

[jmcg]

I have simulate a "bad script" which inside I call "Powershell -mybadcommandline"

I can see/block this commandline using exploit prevention, but i'm not able to locate the script, with this scenario, this script can run in loop without been deleted.