Splunk - Threat Hunting for PowerShell Execution

Splunk - Threat Hunting for PowerShell Execution
SPL Queries used Here :
Windows login event via Powershell as a channel
sourcetype="threathunting*" Channel IN ("Microsoft-Windows-PowerShell/Operational") EventID=4103
| table Channel _time Hostname
| sort -_time
Non-Interactive mode, Powershell spawned from some other process
sourcetype="threathunting**" EventID=4688 NewProcessName="*powershell.exe*" ParentProcessName!="*explorer.exe*"
| stats count by EventID NewProcessName ParentProcessName SubjectUserName SubjectDomainName _time
Event ID = 7, modules/image loaded in the process (process concerned here is Powershell)
sourcetype="threathunting**" Channel="Microsoft-Windows-Sysmon/Operational" EventID=7
| stats count by _time Hostname Image ImageLoaded
EventID = 17 Pipe Creation
sourcetype="threathunting*" Channel="Microsoft-Windows-Sysmon/Operational" EventID=17
| stats count by _time Hostname Image PipeName ProcessId
EventID=53504 "PowerShell Named Pipe IPC”
sourcetype="threathunting*" EventID=53504
| stats count by EventID AccountName Hostname Message

[@shreyasd4663]

Thankyou. Keep posting and i will share this channel with multiple community.

[@cybersecnerd]

Thank you so much! :)

[@Nightmare24102006]

Thanks for the lesson. I look forward to more.

[@cybersecnerd]

You are welcome!