Detecting Code injection with PowerShell in another process

rules/windows/powershell/powershell_code_injection.yml

@@ -0,0 +1,24 @@
+title: Accessing WinAPI in PowerShell. Code Injection.
+id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50
+status: experimental
+description: Detecting Code injection with PowerShell in another process
+author: Nikita Nazarov
+date: 2020/10/06
+references:
+    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
+tags:
+    - attack.execution
+    - attack.t1059.001
+logsource:
+    product: windows
+    service: sysmon
+    definition: 'Note that you have to configure logging for CreateRemoteThread in Symson config'
+detection:
+    selection:
+        EventID:
+            - 8
+        SourceImage: '*\powershell.exe'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high