Analytics BIOC Informational
✕

DSC (Desired State Configuration) lateral movement using PowerShell

An attacker is using the DSC feature with PowerShell to remotely modify / execute content / components on the machine.

Module:
Platform Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
ATT&CK techniques: Windows Management Instrumentation (T1047) Remote Services: Windows Remote Management (T1021.006)
Detector tags: LOLBIN Execution Analytics
Attacker's goals:

Execute malicious content on and move laterally across machine in the network.

Investigative actions:

Search for suspicious WinRM sessions and the user created them, can be found at Event ID: 4102. Additionally, search for the DSC resource executed and related IOC, can be found at Event IDs: 400 or 4104.

Test period:
N/A (single event)
Deduplication:
1 Hour
3 variations:
  • DSC (Desired State Configuration) lateral movement using PowerShell to execute a script High (parent: Informational)
  • DSC (Desired State Configuration) lateral movement using PowerShell to execute a new service Medium (parent: Informational)
  • DSC (Desired State Configuration) lateral movement using PowerShell to modify the registry Medium (parent: Informational)