Osiris Device Guard Bypass - file Invoke-OSiRis.ps1

Hunt Hypothesis

This detection identifies adversaries attempting to bypass Windows Device Guard protections by executing the specific Invoke-OSiRis.ps1 script, a technique often used to evade code integrity controls during initial access or lateral movement phases. Proactive hunting for this behavior in Azure Sentinel is critical because successful bypasses can grant attackers unrestricted execution capabilities, allowing them to deploy custom payloads that would otherwise be blocked by standard security policies.

YARA Rule

rule Invoke_OSiRis {
   meta:
      description = "Osiris Device Guard Bypass - file Invoke-OSiRis.ps1"
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2017-03-27"
      modified = "2025-03-21"
      score = 70
      hash1 = "19e4a8b07f85c3d4c396d0c4e839495c9fba9405c06a631d57af588032d2416e"
      id = "bc0fe826-6c8a-52e6-afb1-85d499093e50"
   strings:
      $x1 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create -Arg $ObfusK -Computer $Target" ascii wide
      $x3 = "-Arg@{Name=$VarName;VariableValue=$OSiRis;UserName=$env:Username}" ascii wide
      $x4 = "Device Guard Bypass Command Execution" ascii wide
   condition:
      filesize < 8MB
      and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Osiris Device Guard Bypass rule triggered by Invoke-OSiRis.ps1, along with recommended filters and exclusions:

• Scenario: Scheduled Endpoint Compliance Scans

  • Context: Enterprise security teams often schedule nightly compliance scans using Microsoft Intune or Qualys Cloud Agent. These agents invoke the Invoke-OSiRis.ps1 script via a Windows Task Scheduler job to verify that Device Guard policies are active and reporting status back to the SIEM.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (TaskScheduler.exe) and the specific Scheduled Task Name (e.g., Osiris_Daily_Compliance_Check). Alternatively, filter by the User Account running the task (e.g., NT AUTHORITY\SYSTEM or a dedicated service account like svc-osiris-agent).

• Scenario: On-Demand Admin Remediation via PowerShell

  • Context: During incident response or routine maintenance, Security Operations Center (SOC) analysts manually execute the script from an elevated command line to force a policy refresh on specific endpoints. This is often done using PowerShell Direct Execution (powershell.exe -ExecutionPolicy Bypass -File Invoke-OSiRis.ps1) by members of the Domain Admins or Security Operations groups.
  • Filter/Exclusion: Exclude events where the Parent Process is pwsh.exe or powershell.exe and the User Account belongs to a specific security group (e.g., SG-Security-Admins). Additionally, filter by the Logon Type being interactive (Type 2) rather than batch/service.

• Scenario: Automated Deployment via Configuration Management Tools

  • Context: Infrastructure teams utilize tools like **Ans