PowerShell HTTP Listener#

Metadata#

Contributors

Roberto Rodriguez @Cyb3rWard0g

Creation Date

2020/11/02

Modification Date

2020/11/02

Tactics

TA0002

Techniques

T1059.001

Tags

None

Dataset Description#

This dataset represents a threat actor using PowerShell to start an HTTP Listener on a compromised endpoint

Simulation Metadata#

Tools#

type

Name

Module

Manual

PowerShell

PowerShell

Adversary View#

$Hso = New-Object Net.HttpListener
$Hso.Prefixes.Add("http://+:8000/")
$Hso.Start()

Explore Datasets#

Download & Decompress Dataset#

import requests
from zipfile import ZipFile
from io import BytesIO

url = https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/execution/host/psh_powershell_httplistener.zip
zipFileRequest = requests.get(url)
zipFile = ZipFile(BytesIO(zipFileRequest.content))
datasetJSONPath = zipFile.extract(zipFile.namelist()[0])

Read JSON File#

from pandas.io import json

df = json.read_json(path_or_buf=datasetJSONPath, lines=True)

Access Security Events#

df.groupby(['Channel']).size().sort_values(ascending=False)