Threat Hunting with PowerShell, YARA and Tools

What it is

A hunting hypothesis needs tools to test it. Three groups matter for the exam:

• PowerShell, built into Windows, to query events, processes, connections, services and persistence locations on one or many hosts.
• YARA, a pattern matching tool that identifies malware and suspicious files with rules based on strings and conditions.
• Hunting tools and telemetry, such as Sysmon, EDR, osquery, Velociraptor, Zeek and the SIEM, that collect and search data at scale.

How it works

Hunting with PowerShell

Short cmdlets answer common hunting questions. They read data; they do not change the system.

Piping the output to Select-Object keeps only the fields of interest, such as CommandLine or PathName. Invoke-Command -ComputerName runs the same query on many remote hosts through PowerShell remoting, which lets one hunter compare a whole server group.

Attackers also abuse PowerShell, so hunters look for it in logs. Script Block Logging writes event 4104 to the Microsoft-Windows-PowerShell/Operational log, recording the code that ran even when it was obfuscated. Signs worth hunting include encoded commands (the -EncodedCommand parameter), download cradles that fetch and run remote scripts, and PowerShell started by Office applications.

Hunting with YARA

A YARA rule has a name, optional meta information, strings to look for, and a condition that decides a match. Strings can be text, hexadecimal bytes or regular expressions.

rule Suspicious_Credential_Tool
{
    meta:
        description = "Flags Windows executables that contain credential dumping tool strings"
    strings:
        $mz = { 4D 5A }
        $s1 = "sekurlsa::logonpasswords" nocase
        $s2 = "mimikatz" nocase
    condition:
        $mz at 0 and any of ($s1, $s2)
}

The condition requires the MZ header at offset 0 (a Windows executable) and at least one of the two strings. A scan of a folder and its subfolders looks like yara -r rules.yar C:\Users. YARA can also scan a running process's memory by process ID.

Hunters write YARA rules from malware analysis or intelligence reports, then sweep endpoints, file shares and email attachments for matches. Many EDR and sandbox products accept YARA rules directly.

Sysmon and other hunting tools

Sysmon (System Monitor, part of Microsoft Sysinternals) adds detailed telemetry to the Windows event log.

A worked example

The hypothesis is credential dumping on file servers. The hunter searches Sysmon event 10 for processes opening lsass.exe and finds an unsigned executable in a temporary folder on one server. A Get-FileHash of the file returns a hash unknown to the TIP, and Get-CimInstance Win32_Process shows it was started by a scheduled task.

A YARA sweep with the rule above matches the file and one copy on a second server. The hunter hands both hosts to incident response and adds a detection for unusual LSASS access.

How the exam asks about this

• "Which tool identifies malware families using rules made of strings and conditions?" → YARA.
• "Which Sysmon event ID records process creation with the command line?" → Event ID 1.
• "Which PowerShell event ID records the content of executed script blocks?" → Event ID 4104.