Potential Script Proxy Execution Via CL_Mutexverifiers.ps1

Title: Potential Script Proxy Execution Via CL_Mutexverifiers.ps1
Status: test
Description:Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands
References:
  -https://lolbas-project.github.io/lolbas/Scripts/CL_mutexverifiers/
Author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova, frack113
Date: 2022-05-21
modified:2023-08-17
Tags:

• -'attack.stealth'
• -'attack.t1216'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_pwsh:
    ParentImage|endswith:
      -'\powershell.exe'
      -'\pwsh.exe'

    Image|endswith: '\powershell.exe'
    CommandLine|contains: ' -nologo -windowstyle minimized -file '
  selection_temp:
    CommandLine|contains:
      -'\AppData\Local\Temp\'
      -'\Windows\Temp\'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium