HackTool - Covenant PowerShell Launcher

Title: HackTool - Covenant PowerShell Launcher
Status: test
Description:Detects suspicious command lines used in Covenant luanchers
References:
  -https://posts.specterops.io/covenant-v0-5-eee0507b85ba
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2020-06-04
modified:2023-02-21
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059.001'
• -'attack.t1564.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_1:
    CommandLine|contains|all:
      -'-Sta'
      -'-Nop'
      -'-Window'
      -'Hidden'

    CommandLine|contains:
      -'-Command'
      -'-EncodedCommand'

  selection_2:
    CommandLine|contains:
      -'sv o (New-Object IO.MemorySteam);sv d '
      -'mshta file.hta'
      -'GruntHTTP'
      -'-EncodedCommand cwB2ACAAbwAgA'

  condition:1 of selection_*
Falsepositives:
Level: high