topic Re: PowerShell detected as Malware in Endpoint Security

PowerShell detected as Malware

Hellen Queiros Brito — Wed, 13 Jul 2022 12:16:15 GMT

For a long time I received many alerts about the Powershell being indentified as Malware, when a retrospective Malware alert was received making that file as Clean.

Common detecion: W32.PowershellEncodedBuffer.ioc

Did anyone else see this same behavior?

Re: PowerShell detected as Malware

Troja007 — Fri, 15 Jul 2022 09:00:49 GMT

Hello @Hellen Queiros Brito ,
FYI, the IOC does not outline that Powershell itself is malware, it outlines that something malicious may has been done with powershell. This IOC has been seen often in the past. It outlines, in most cases, that the command line includes a base64 encoded string. This technique can be used to hide something. This technique is also described by MITRE to obfuscate something.

Two things:

i assume the IOC shows a severity level low, right?
The IOC should also outline the string which was encoded, right?

Greetings,
Thorsten

Re: PowerShell detected as Malware

Hellen Queiros Brito — Fri, 25 Nov 2022 19:38:34 GMT

Hello @Troja007 .

Yes it's right. Shows as severety level low and it's was encoded too.

and what can we do in this case, I still receive several alerts regarding the PS and in another topic on the cisco blog it was mentioned that an isolated case would not be serious, but several alerts would already become worrying, relating to cases of LOLBins

Thank you for your help!!

Re: PowerShell detected as Malware

Troja007 — Mon, 28 Nov 2022 08:14:03 GMT

Hello @hell ,
there are two options.

Short Term: You may open a TAC case, so an exclusion gets added to your environment.
Mid Term: We will provide IOC exclusions soon, so customer can configure their own IOC exclusions.

Greetings,
Thorsten

Re: PowerShell detected as Malware

Hellen Queiros Brito — Mon, 28 Nov 2022 20:55:34 GMT

Thank you @Troja007

Re: PowerShell detected as Malware

Troja007 — Tue, 29 Nov 2022 09:36:18 GMT

Hello @Hellen Queiros Brito ,
FYI, custom CloudIOC exclusions have been released. They are handled and configured in the same way as any other exclusions.
Greetings,
Thorsten