This hunt targets adversaries leveraging PowerStager to stage PowerShell scripts via native Windows executables, a technique often used to bypass initial execution controls during early attack phases. Proactively hunting for these artifacts in Azure Sentinel is critical because their low-severity classification may cause them to be overlooked amidst high-volume noise, allowing attackers to establish persistence undetected before escalating their operations.
rule Powerstager
{
meta:
author = "Jeff White - jwhite@paloaltonetworks.com @noottrak"
date = "02JAN2018"
hash1 = "758097319d61e2744fb6b297f0bff957c6aab299278c1f56a90fba197795a0fa" //x86
hash2 = "83e714e72d9f3c500cad610c4772eae6152a232965191f0125c1c6f97004b7b5" //x64
description = "Detects PowerStager Windows executable, both x86 and x64"
reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-powerstager-analysis/"
reference2 = "https://github.com/z0noxz/powerstager"
strings:
$filename = /%s\\[a-zA-Z0-9]{12}/
$pathname = "TEMP" wide ascii
// $errormsg = "The version of this file is not compatible with the version of Windows you're running." wide ascii
$filedesc = "Lorem ipsum dolor sit amet, consecteteur adipiscing elit" wide ascii
$apicall_01 = "memset"
$apicall_02 = "getenv"
$apicall_03 = "fopen"
$apicall_04 = "memcpy"
$apicall_05 = "fwrite"
$apicall_06 = "fclose"
$apicall_07 = "CreateProcessA"
$decoder_x86_01 = { 8D 95 [4] 8B 45 ?? 01 D0 0F B6 18 8B 4D ?? }
$decoder_x86_02 = { 89 C8 0F B6 84 05 [4] 31 C3 89 D9 8D 95 [4] 8B 45 ?? 01 D0 88 08 83 45 [2] 8B 45 ?? 3D }
$decoder_x64_01 = { 8B 85 [4] 48 98 44 0F [7] 8B 85 [4] 48 63 C8 48 }
$decoder_x64_02 = { 48 89 ?? 0F B6 [3-6] 44 89 C2 31 C2 8B 85 [4] 48 98 }
condition:
uint16be(0) == 0x4D5A
and
all of ($apicall_*)
and
$filename
and
$pathname
and
$filedesc
and
(2 of ($decoder_x86*) or 2 of ($decoder_x64*))
}This YARA rule can be deployed in the following contexts:
This rule contains 15 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the PowerStager detection rule in an enterprise environment, along with recommended filters or exclusions:
Microsoft Endpoint Configuration Manager (MECM/SCCM) Application Deployment
ccmexec.exe) launches PowerStager.exe to distribute and update the Microsoft Office 365 suite or internal line-of-business applications across thousands of endpoints. This often occurs during business hours when users are actively working, triggering the rule on user workstations rather than just management servers.PowerStager.exe where the parent process is ccmexec.exe. Additionally, filter by the specific command line argument containing /appname or /taskid which are unique to SCCM deployment jobs.Automated Office 365 Click-to-Run Updates via Task Scheduler
PowerStager.exe to check for and apply the latest Microsoft Office updates. This is a legitimate, high-frequency background task that runs automatically on all domain-joined machines, often generating alerts during peak update windows (e.g., 2:00 AM or lunch hours).svchost.exe with the service name Schedule, and the file path of PowerStager.exe matches the standard Microsoft installation directory (e.g., C:\Program Files\Microsoft Office\Office16).IT Helpdesk Remote Session Management Tools