> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/advanced-log-analysis/distinguishing-between-legitimate-and-malicious-powershell-executions.md).

# Distinguishing Between Legitimate and Malicious PowerShell Executions

PowerShell is a powerful tool often leveraged by attackers for malicious purposes. Distinguishing between legitimate and malicious executions requires analyzing multiple indicators within logs, including command-line arguments, context, and behavior.

***

## **1. Analyze Command Line Arguments**

* **What to Look For:**
  * Malicious PowerShell commands often include:
    * **`-EncodedCommand:`** Indicates an encoded payload, which attackers use to hide malicious commands.
    * **`-ExecutionPolicy Bypass:`** Bypasses execution policy restrictions, a common tactic for running unsigned scripts.
    * **`-NoProfile:`** Prevents loading user profiles, often used to evade detection.
    * Network-related actions such as **`Invoke-WebRequest`**, **`New-Object Net.WebClient`**, or commands for downloading files.
  * Full URLs, IP addresses, or data exfiltration commands may also be present.
* **Analysis Tip:** Legitimate scripts rarely include a combination of these flags and arguments unless they’re part of an administrative task.

***

## **2. Check for Obfuscation**

* **What to Look For:**
  * Heavy use of obfuscation techniques such as:
    * **Base64-encoded commands.**
    * Random string concatenation using **`+`** or **`"`** to split keywords.
    * Excessive use of aliases (e.g., **`iwr`** for **`Invoke-WebRequest`**) or nested commands.
  * Examples of suspicious obfuscated code:
    * `"I`+"nvok"+"e-Ex"+"pre"+"ss"+"ion"\`
    * Base64 string following **`-EncodedCommand`**.
* **Legitimate Scripts:** Typically do not rely on obfuscation, as clarity is needed for debugging and maintenance.

***

## **3. Review the Context**

* **Parent Process:**
  * Malicious PowerShell processes are often spawned by unusual parent processes such as:
    * **`explorer.exe, winword.exe, outlook.exe, rundll32.exe`.**
  * Legitimate PowerShell processes are usually launched by **`powershell.exe`** or administrative tools.
* **Trigger Source:**
  * Check if the process was:
    * **User-triggered:** Associated with an expected administrative task.
    * **Automated:** Scheduled or hidden processes may indicate malicious intent.
  * Example: A PowerShell script triggered by opening a document in **Microsoft Word** is highly suspicious.

***

## **4. Check Execution Frequency**

* **What to Look For:**
  * Repeated or unusual scheduling of the script.
  * Processes running at times or intervals inconsistent with legitimate tasks.
* **Red Flags:**
  * Scripts running as a **Scheduled Task** or via **Startup Folder** without clear purpose.
  * Execution during off-hours (e.g., late at night, weekends) when administrative tasks are unlikely.

***

## **5. Cross-Reference with Threat Intelligence**

* **What to Do:**
  * Compare observed behaviors with threat intelligence feeds or databases like:
    * MITRE ATT\&CK for known tactics.
    * VirusTotal for hashing of encoded scripts.
    * Threat intelligence feeds for known Indicators of Compromise (IoCs), such as malicious IPs or domains.
  * Look for overlaps with reported attack patterns or tools used by known adversaries.
* **Benefit:** Many malicious actors reuse PowerShell techniques, making them recognizable via intelligence sources.

***

## **6. Evaluate Permissions and Impact**

* **What to Look For:**
  * Scripts attempting actions like:
    * Elevating privileges with **`Start-Process`** or **`Invoke-Command`**.
    * Modifying critical system settings or registries.
    * Accessing protected directories or system files.
* **Legitimate Use Cases:**
  * Administrative tasks typically require elevated privileges but are well-documented and tied to known activities.

***

## **7. Investigate Network Activity**

* **What to Look For:**
  * PowerShell making network connections:
    * **`Invoke-WebRequest`** or **`Invoke-RestMethod`** for file downloads.
    * **`Net.WebClient`** objects for C2 communication.
    * Outbound connections to unknown or foreign IPs/domains.
  * **Indicators of Malicious Intent:**
    * Downloading executables, scripts, or payloads.
    * Connecting to known malicious C2 servers or domains flagged by threat intelligence.
* **Legitimate Scripts:** Rarely involve direct outbound network communication unless for routine administrative tasks.

***

## **8. Response**

* **Immediate Actions:**
  * Terminate the PowerShell process if deemed malicious.
  * Isolate the affected system to prevent further execution or lateral movement.
* **Forensic Analysis:**
  * Capture the full command line for the suspicious PowerShell execution.
  * Save associated artifacts (e.g., scripts, logs, downloaded files) for deeper analysis.
* **Preventative Measures:**
  * Develop and apply detection rules in SIEM or EDR systems to flag similar patterns in the future.
  * Block network connections to malicious IPs or domains at the firewall.
  * Enforce strict PowerShell logging policies, including module logging and transcription.

***

## **Enhancing Detection and Prevention**

* **Enable PowerShell Logging:**
  * Turn on **Script Block Logging** and **Module Logging** to capture detailed script execution.
  * Leverage **Microsoft Advanced Threat Analytics (ATA)** or similar tools for real-time monitoring.
* **Restrict PowerShell Usage:**
  * Limit PowerShell access to administrators only.
  * Use **Constrained Language Mode** for users who don’t require full functionality.
* **Educate Users and Administrators:**
  * Train staff to recognize phishing tactics and malicious documents that often trigger PowerShell attacks.

***

## **Conclusion**

By carefully analyzing logs and correlating them with context, behavior, and threat intelligence, security analysts can effectively distinguish between legitimate and malicious PowerShell executions. Early detection and response are critical to preventing further compromise.