I was reading an article about searching for Fileless Malware (https://www.ultimatewindowssecurity.com/) and I was trying to build a PS script to do it.
I started with this:
$filename=Get-Process
-module|selectModuleName,filename
foreach ($filein$filename){
write$file
get-item$file|
selectlength
|where ($.length-cle'0')}
However, line 1 is causing me some grief…
When I run Get-Process, I get this result (as expected):
PS C:\WINDOWS\system32> Get-Process
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
384 22 16132 30692 0.23 3528 1 ApplicationFrameHost
457 67 13900 27504 0.88 4836 0 AppVClient
377 24 45788 44744 0.61 8520 1 AppVStreamingUX
When I run $Filename = Get-Process, I get this result (nothing):
PS C:\WINDOWS\system32> $Filename = Get-Process
PS C:\WINDOWS\system32>
When I run Get-Process –module , I this result (as expected):
PS C:\WINDOWS\system32> Get-Process –module
Size(K) ModuleName FileName
----- ---------- -------- 80 ApplicationFrameHost.exe C:\WINDOWS\system32\ApplicationFrameHost.exe 1924 ntdll.dll C:\WINDOWS\SYSTEM32\ntdll.dll 712
KERNEL32.DLL C:\WINDOWS\System32\KERNEL32.DLL
When I add the variable on $Filename = Get-Process –module, I get this result (unexpected):
PS C:\WINDOWS\system32> $Filename = Get-Process –module
Get-Process : Cannot enumerate the modules of the "csrss" process.
At line:1 char:13
+ $Filename = Get-Process –module
+ ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (System.Diagnostics.Process (csrss):Process) [Get-Process], ProcessCommandException
+ FullyQualifiedErrorId : CouldnotEnumerateModules,Microsoft.PowerShell.Commands.GetProcessCommand
I even tried:
- “invoke-command {Get-Process-module|
selectModuleName,filename}” which worked, but once I added the “$filename =” back in it breaks “Cannot
enumerate…”.
- “Get-Process| ? { (get-process-id$_.id-module|
? {$_.length-cle"0"})}”, but it also breaks “Cannot enumerate…”.
The only possible solution that I may have found is “Get-Process|where {$_.Modules-like'*'}
|? {$_.length-cle"0"}” –where it returns no results, but that might just meant that I don’t have any fileless processes running.
Thoughts?
FamilyMan