Suspicious Interactive PowerShell as SYSTEM

Title: Suspicious Interactive PowerShell as SYSTEM
Status: test
Description:Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context
References:
  -https://jpcertcc.github.io/ToolAnalysisResultSheet/details/PowerSploit_Invoke-Mimikatz.htm
Author: Florian Roth (Nextron Systems)
Date: 2021-12-07
modified:2022-08-13
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename:
      -'C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt'
      -'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive'

  condition:selection
Falsepositives:
  -Administrative activity
  -PowerShell scripts running as SYSTEM user
Level: high