AgentExecutor PowerShell Execution

testmedium
log source: windows · process_creationauthor Nasreddine Bencherchali (Nextron Systems), memory-shardsdate 2022-12-24
01

description

What this is, in brief.

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

02

tags

attack.stealthattack.t1218
03

rule source (YAML)

title: AgentExecutor PowerShell Execution
id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61
related:
    - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab
      type: similar
status: test
description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument
author: Nasreddine Bencherchali (Nextron Systems), memory-shards
references:
    - https://twitter.com/lefterispan/status/1286259016436514816
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/
    - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
    - https://twitter.com/jseerden/status/1247985304667066373/photo/1
date: 2022-12-24
modified: 2024-08-07
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image: '\AgentExecutor.exe'
        - OriginalFileName: 'AgentExecutor.exe'
    selection_cli:
        # Example:
        #   AgentExecutor.exe -powershell [scriptPath] [outputFilePath] [errorFilePath] [timeoutFilePath] [timeoutSeconds] [powershellPath] [enforceSignatureCheck] [runAs32BitOn64]
        # Note:
        #   - If [timeoutSeconds] is NULL then it defaults to 60000
        #   - If [enforceSignatureCheck] is:
        #       - "NULL" or "1" then a PowerShell instance is spawned with the args: "-NoProfile -executionPolicy allsigned -file "
        #       - Else a PowerShell instance is spawned with the args: "-NoProfile -executionPolicy bypass -file "
        #   - [powershellPath] is always concatendated to "powershell.exe"
        CommandLine|contains:
            - ' -powershell' # Also covers the "-powershellDetection" flag
            - ' -remediationScript'
    filter_main_intune:
        ParentImage|endswith: '\Microsoft.Management.Services.IntuneWindowsAgent.exe'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Legitimate use via Intune management. You exclude script paths and names to reduce FP rate
level: medium
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.