The evasive-powershell-executions rule detects potential Jupyter/SolarMarker malware activity by identifying suspicious PowerShell executions that evade standard detection mechanisms. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage info-stealing and backdoor activities associated with this sophisticated malware family.
KQL Query
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_all
("-command","FromBase64String","));remove-item $",".length;$j++){$","$i++;if($i -ge $","-bxor","UTF8.GetString")
id: 33e69a06-206e-4eda-930d-13d2f61f9185
name: evasive-powershell-executions
description: |
Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- DeviceProcessEvents
tactics:
- Execution
query: |
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_all
("-command","FromBase64String","));remove-item $",".length;$j++){$","$i++;if($i -ge $","-bxor","UTF8.GetString")
| Sentinel Table | Notes |
|---|---|
DeviceProcessEvents | Ensure this data connector is enabled |
Scenario: Legitimate PowerShell script used for system monitoring via Get-EventLog
Filter/Exclusion: ProcessCommandLine -notlike "*Get-EventLog*"
Scenario: Scheduled job running a PowerShell script for log rotation using Remove-Item
Filter/Exclusion: ProcessCommandLine -notlike "*Remove-Item*"
Scenario: Admin using Invoke-Command to run a script on a remote server for patching
Filter/Exclusion: ProcessCommandLine -notlike "*Invoke-Command*"
Scenario: Use of Out-File to export logs to a CSV file for auditing purposes
Filter/Exclusion: ProcessCommandLine -notlike "*Out-File*"
Scenario: PowerShell script used for generating reports with Export-Csv and Get-ChildItem
Filter/Exclusion: ProcessCommandLine -notlike "*Export-Csv*"