Talos Study Finds Rare PowerShell Domains Trend Toward Higher Maliciousness

Summary

Talos analyzed six months of PowerShell network telemetry and found rare domains had a higher observed malicious rate, but the difference was not statistically significant. The study also highlights the need to inspect subdomains and process arguments.

Key points

The study analyzed 3,220,829 PowerShell connection events from June 1 to Dec. 31, 2024, covering 742 unique base domains.
Talos classified 550 domains as rare, using an average of five or fewer contacts per full domain.
Nine rare domains (1.64%) and one non-rare domain (0.52%) were assessed as malicious; the estimated odds ratio was 3.18.
The difference was not statistically significant, and the authors note the small number of malicious domains.
Five of 10 reviewed connections to raw.githubusercontent.com involved potentially malicious PowerShell commands, including downloading or executing PowerSploit or Invoke-Mimikatz.
Among the other processes studied, wscript.exe had five malicious domains among 82; results for the other processes showed few or no malicious domains.
Talos recommends investigating rare domains while also reviewing subdomains and process arguments to catch malicious activity on commonly contacted domains.

Article Details

Publisher: Cisco Talos
Report Period: 2024-06-01 to 2024-12-31
Scope: PowerShell network connection telemetry, with comparisons to rundll32.exe, Python, cmd.exe, cscript.exe, wscript.exe, bash, zsh, and csh.
Sample Size: PowerShell dataset: 3,220,829 log events and 742 unique base domains.
Key Statistics: 550 of 742 PowerShell base domains (74.1%) met the rare-domain threshold of at most five average contacts per full domain.
Rare PowerShell domains: 9 of 550 (1.64%) were classified as malicious; 95% CI: 0.86%–3.08%.
Non-rare PowerShell domains: 1 of 192 (0.52%) was classified as malicious; 95% CI: 0.09%–2.89%.
The odds ratio for a rare domain being malicious was 3.18 (95% CI: 0.39–25.9), but the association was not statistically significant (chi-square p=0.4291; Fisher’s exact p=0.4668).
For wscript.exe, 5 of 82 contacted domains were classified as malicious; 58 domains were rare.
Recommendations: Prioritize investigation of rare domains, particularly for PowerShell and wscript, while accounting for the study’s statistical non-significance.
Analyze subdomains and process arguments for frequently contacted domains.
Combine automated threat intelligence with manual review to reduce false positives and identify nuanced threats.
Investigate anomalous utilization of wscript.exe, especially in environments where its use is rare.