Skip to content

Commit 6e195c3

Browse files
tomsonpltomsonpl
committed
powershell history artifact
1 parent 43e4d46 commit 6e195c3

File tree

2 files changed

+139
-6
lines changed

2 files changed

+139
-6
lines changed

‎packages/osquery_manager/artifacts_matrix.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,19 @@
22

33
This document tracks the coverage of forensic artifacts in Osquery.
44

5-
**Last Updated**: 2025-11-07
6-
**Total Core Artifacts**: 1 available + 39 in progress + 6 not available = 46 total variants
5+
**Last Updated**: 2025-11-21
6+
**Total Core Artifacts**: 2 available + 38 in progress + 6 not available = 46 total variants
77
**Total Queries**: 30 (3 core forensic variants + 27 additional)
8-
**Completion Rate**: 2.2% (1/46 core artifacts fully supported)
8+
**Completion Rate**: 4.3% (2/46 core artifacts fully supported)
99

1010
---
1111

1212
## Coverage Summary
1313

1414
| Status | Count | Percentage |
1515
|--------|-------|------------|
16-
| ✅ Available (Fully Supported) | 0 | 0% |
17-
| ⚠️ In Progress (Needs Validation) | 39 | 87.0% |
16+
| ✅ Available (Fully Supported) | 2 | 4.3% |
17+
| ⚠️ In Progress (Needs Validation) | 38 | 82.6% |
1818
| ❌ Not Available (Requires Extensions) | 6 | 13.0% |
1919

2020
---
@@ -53,7 +53,7 @@ This document tracks the coverage of forensic artifacts in Osquery.
5353
| 14 | Persistence | ⚠️ | Win | - | - | Supported across multiple tables (services, startup_items, scheduled_tasks) |
5454
| 14a | Persistence | ⚠️ | Linux | - | - | Supported across multiple tables (services, startup_items, scheduled_tasks) |
5555
| 14b | Persistence | ⚠️ | Mac | - | - | Supported across multiple tables (services, startup_items, scheduled_tasks) |
56-
| 15 | PowerShell History | ⚠️ | Win | - | - | powershell_events table |
56+
| 15 | PowerShell History | ✅ | Win | [a1b2](kibana/osquery_saved_query/osquery_manager-a1b2c3d4-e5f6-11ed-8f39-bf9c07530bbb.json) | powershell_events | Comprehensive PowerShell forensic monitoring (Event IDs 4103, 4104, 4688) for fileless malware detection |
5757
| 16 | Prefetch Files | ⚠️ | Win | - | - | prefetch table |
5858
| 17 | Process Listing | ⚠️ | Win | - | - | processes table |
5959
| 17a | Process Listing | ⚠️ | Linux | - | - | processes table |

‎packages/osquery_manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-e5f6-11ed-8f39-bf9c07530bbb.json‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
{
2+
"attributes": {
3+
"created_at": "2025-11-21T00:00:00.000Z",
4+
"created_by": "elastic",
5+
"description": "Comprehensive PowerShell forensic monitoring query capturing module logging (Event ID 4103), script block logging (Event ID 4104), and process creation with command line auditing (Event ID 4688). This query detects obfuscated commands, full script execution, and parent/child process relationships for fileless malware detection.",
6+
"ecs_mapping": [
7+
{
8+
"key": "event.created",
9+
"value": {
10+
"field": "datetime"
11+
}
12+
},
13+
{
14+
"key": "event.code",
15+
"value": {
16+
"field": "eventid"
17+
}
18+
},
19+
{
20+
"key": "event.provider",
21+
"value": {
22+
"field": "provider_name"
23+
}
24+
},
25+
{
26+
"key": "log.level",
27+
"value": {
28+
"field": "level"
29+
}
30+
},
31+
{
32+
"key": "host.name",
33+
"value": {
34+
"field": "computer_name"
35+
}
36+
},
37+
{
38+
"key": "process.pid",
39+
"value": {
40+
"field": "pid"
41+
}
42+
},
43+
{
44+
"key": "process.thread.id",
45+
"value": {
46+
"field": "tid"
47+
}
48+
},
49+
{
50+
"key": "event.action",
51+
"value": {
52+
"field": "task"
53+
}
54+
},
55+
{
56+
"key": "powershell.provider.name",
57+
"value": {
58+
"field": "ProviderName"
59+
}
60+
},
61+
{
62+
"key": "powershell.context_info",
63+
"value": {
64+
"field": "ContextInfo"
65+
}
66+
},
67+
{
68+
"key": "powershell.payload",
69+
"value": {
70+
"field": "Payload"
71+
}
72+
},
73+
{
74+
"key": "powershell.file.script_block_id",
75+
"value": {
76+
"field": "ScriptBlockId"
77+
}
78+
},
79+
{
80+
"key": "powershell.file.script_block_text",
81+
"value": {
82+
"field": "ScriptBlockText"
83+
}
84+
},
85+
{
86+
"key": "file.path",
87+
"value": {
88+
"field": "ScriptPath"
89+
}
90+
},
91+
{
92+
"key": "process.command_line",
93+
"value": {
94+
"field": "CommandLine"
95+
}
96+
},
97+
{
98+
"key": "process.name",
99+
"value": {
100+
"field": "ProcessName"
101+
}
102+
},
103+
{
104+
"key": "process.parent.name",
105+
"value": {
106+
"field": "ParentProcessName"
107+
}
108+
}
109+
],
110+
"id": "powershell_events_windows_elastic",
111+
"interval": "300",
112+
"platform": "windows",
113+
"query": "-- Comprehensive PowerShell Forensic Monitoring Query\n-- Captures Event IDs 4103 (Module Logging), 4104 (Script Block Logging), 4688 (Process Creation)\n-- Source: windows_eventlog table - Windows Event Logs (Historical)\n-- Focus: Fileless malware detection, obfuscated command tracking, command line auditing\n-- MITRE ATT&CK: T1059.001 (PowerShell)\n-- Last updated: 2025-11-21\n\n-- Query PowerShell Operational logs for Event IDs 4103 and 4104\nSELECT\n datetime,\n eventid,\n provider_name,\n level,\n task,\n computer_name,\n channel,\n pid,\n tid,\n data,\n -- Event ID 4103: Module Logging - Extract obfuscated command context\n CASE \n WHEN eventid = 4103 THEN json_extract(data, '$.EventData.ProviderName')\n ELSE NULL\n END AS ProviderName,\n CASE \n WHEN eventid = 4103 THEN json_extract(data, '$.EventData.ContextInfo')\n ELSE NULL\n END AS ContextInfo,\n CASE \n WHEN eventid = 4103 THEN json_extract(data, '$.EventData.Payload')\n ELSE NULL\n END AS Payload,\n -- Event ID 4104: Script Block Logging - Extract full script content\n CASE \n WHEN eventid = 4104 THEN json_extract(data, '$.EventData.ScriptBlockId')\n ELSE NULL\n END AS ScriptBlockId,\n CASE \n WHEN eventid = 4104 THEN json_extract(data, '$.EventData.ScriptBlockText')\n ELSE NULL\n END AS ScriptBlockText,\n CASE \n WHEN eventid = 4104 THEN json_extract(data, '$.EventData.Path')\n ELSE NULL\n END AS ScriptPath,\n NULL AS CommandLine,\n NULL AS ProcessName,\n NULL AS ParentProcessName\nFROM windows_eventlog\nWHERE \n channel = 'Microsoft-Windows-PowerShell/Operational'\n AND eventid IN (4103, 4104)\nUNION ALL\n-- Query Security logs for Event ID 4688 (Process Creation)\nSELECT\n datetime,\n eventid,\n provider_name,\n level,\n task,\n computer_name,\n channel,\n pid,\n tid,\n data,\n NULL AS ProviderName,\n NULL AS ContextInfo,\n NULL AS Payload,\n NULL AS ScriptBlockId,\n NULL AS ScriptBlockText,\n NULL AS ScriptPath,\n -- Event ID 4688: Process Creation - Extract command line and process hierarchy\n json_extract(data, '$.EventData.CommandLine') AS CommandLine,\n json_extract(data, '$.EventData.NewProcessName') AS ProcessName,\n json_extract(data, '$.EventData.ParentProcessName') AS ParentProcessName\nFROM windows_eventlog\nWHERE \n channel = 'Security'\n AND eventid = 4688\n AND data LIKE '%powershell%'\nORDER BY datetime DESC;",
114+
"tags": [
115+
"T1059.001",
116+
"PowerShell",
117+
"Execution",
118+
"Fileless Malware",
119+
"Script Block Logging",
120+
"Module Logging",
121+
"Process Auditing"
122+
],
123+
"updated_at": "2025-11-21T00:00:00.000Z",
124+
"updated_by": "elastic",
125+
"version": "1.0.0"
126+
},
127+
"coreMigrationVersion": "8.3.3",
128+
"id": "osquery_manager-a1b2c3d4-e5f6-11ed-8f39-bf9c07530bbb",
129+
"references": [],
130+
"type": "osquery-saved-query",
131+
"updated_at": "2025-11-21T00:00:00.000Z",
132+
"version": "WzEwNTUzLDJd"
133+
}

0 commit comments

Comments
 (0)