mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-28 12:19:41 +03:00

Files

T

Kevin Glynn d4e38c2867 fix: reduce Windows Defender false positive on fileless malware skill

Add AV false-positive guidance for issue #100, move inline YARA rule to
references/yara-fileless-powershell.yar, and replace literal encoded
PowerShell payload with a placeholder in the sample report.

2026-07-16 17:08:46 -04:00

2.5 KiB

Raw Blame History

Fileless Malware Detection API Reference

Windows Event IDs for Fileless Detection

Event ID	Log	Description
4104	PowerShell Operational	Script Block Logging (full script content)
4103	PowerShell Operational	Module Logging
1	Sysmon	Process Creation with command line
8	Sysmon	CreateRemoteThread (injection)
10	Sysmon	ProcessAccess (injection prep)
19/20/21	Sysmon	WMI Event Filter/Consumer/Binding
7045	System	New service installed

python-evtx - Parse Windows Event Logs

import Evtx.Evtx as evtx

with evtx.Evtx("Security.evtx") as log:
    for record in log.records():
        xml = record.xml()
        if "<EventID>4104</EventID>" in xml:
            print(record.timestamp(), xml[:500])

Volatility 3 Commands

# Detect injected code (RWX memory, PE headers in non-image VADs)
vol3 -f memory.dmp windows.malfind

# List processes
vol3 -f memory.dmp windows.pslist

# Scan for hidden processes
vol3 -f memory.dmp windows.psscan

# List loaded DLLs
vol3 -f memory.dmp windows.dlllist --pid 1234

# Extract injected code
vol3 -f memory.dmp windows.malfind --dump --pid 1234

LOLBins Detection Patterns (Sysmon)

<!-- Sysmon config for LOLBin monitoring -->
<RuleGroup groupRelation="or">
  <ProcessCreate onmatch="include">
    <Image condition="end with">mshta.exe</Image>
    <Image condition="end with">regsvr32.exe</Image>
    <Image condition="end with">certutil.exe</Image>
    <Image condition="end with">wmic.exe</Image>
    <Image condition="end with">cmstp.exe</Image>
    <Image condition="end with">msbuild.exe</Image>
  </ProcessCreate>
</RuleGroup>

Suspicious PowerShell Indicators

Detection patterns to search for in Script Block Logging (Event ID 4104) and memory strings. See yara-fileless-powershell.yar in this directory for a Volatility YARA rule covering the same indicators.

-enc / -EncodedCommand    → Base64-encoded command
IEX / Invoke-Expression   → Dynamic code execution
Net.WebClient             → Download cradle
DownloadString()          → Remote script fetch
Reflection.Assembly       → Reflective .NET loading
VirtualAlloc              → Shellcode allocation
FromBase64String          → Payload decoding

WMI Persistence Check

# List WMI event subscriptions
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class __EventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

2.5 KiB Raw Blame History