Connection to WebService by an Unsigned Binary

[rule]
description = """
Identifies DNS queries to common web services by an unsigned program. Adversaries may implement command and control
communications that use common web services in order to hide their activity.
"""
id = "2c3efa34-fecd-4b3b-bdb6-30d547f2a1a4"
license = "Elastic License v2"
name = "Connection to WebService by an Unsigned Binary"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/globally-distributed-stealers"]
version = "1.0.54"

query = '''
sequence by process.entity_id with maxspan=5m
 /* execution of an unsigned PE file followed by dns lookup to commonly abused trusted webservices */

  [process where event.action == "start" and
   not process.code_signature.trusted == true and
   (process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
   not process.hash.sha256 : ("7ce7b2c97b242169333c0920497299e070a5d19900f1751ccf691424e3572c0b",
                              "21f061b2c1a9d86b25355ed5a4a52302e9797bd83c19b7ff7bffb6312e4b20ae",
                              "13b83cc30cafdf1158c5916ed147baeccd974a5998268d331454e839684136dd",
                              "eef030ce340a68e7f9370146b5ae770c2545dd7e66359dae8b82222f7e7868e1",
                              "5c714275f327385f539a95dd86385c16db79891d7818fd15fcb32f51441a6c8c",
                              "d8b2ba96f2b18a89942c53651c15d477d94495e6c70645e8e72266b87f6b7eb5",
                              "652f26a69f928aa7800a2df3345d770cd290a7ea46ba8e97fe7b284fecbd9b56",
                              "53cec05a7fe060e26a3d84be15c91eac2269e6c6ed9570e2315bad26dd92d230",
                              "b40b9456b3816a2b2710bb6b4860bcca74dd55eef6a9f9c1119e51c1b58dd17b",
                              "ac3bc762543ae3875b1d55d61b7b6740faff186edc959c1490ebc6d176b0f092",
                              "b3dce1fda6820e5e3df33fa2e1bd9c87fe5ed6b2f44f6e6c47a32a870f0e0935",
                              "d7b0cc901f7d427d17df5a59c0261e415da2f4f6c44c2429c1514a0b3327f6f3",
                              "73ee5886a3d7ea73cd5ba31d943f1067f622eafe0f701ab23d2d9d3c1c0aafa5",
                              "438e750547cca4c4aaf49a5cafcfa9bbe8b9cc51772dba2791e966a9f92cad5a",
                              "b3dce1fda6820e5e3df33fa2e1bd9c87fe5ed6b2f44f6e6c47a32a870f0e0935",
                              "d49609714d5b5031f2f08470485220323ee056bde2079fb5faf763a77cd53ddb",
                              "6f92b27bb0387b2b49ac2ed9eb7b3632e72507de64c691eb084202e9429786e3",
                              "3c7f2519b3eb76408e8acc4016da9d710f0d528b2b6b5291102d8d79ffeeb8c1",
                              "464637413f656379e8e7b131c57ad7a5eed95d54714a8e0d130da35ba04fca69",
                              "f3785c74dd0bd8b629f1f8480134a7d9ef94ae9a3d28a72cde8b6f9debdb829c",
                              "432631e2a7195a94c2a02103031b4f213b66cfcce40f1dffcbbec46b0d3c254b",
                              "d3d47bd13b9d18619d541f553d0d06174f9daae26d83f7136361b07aca378c86",
                              "58139bcb2e48d341bd74557d52cf074ccd0f74142da254b47d4e1dfcc4fdffd4",
                              "0165fe4269fe548c64de31e559bd0f5186316008d797739b39bb10021b356baf") and
   not process.parent.executable like "C:\\Program Files\\Microsoft Visual Studio\\*.exe" and
   not process.executable : "C:\\Program Files\\Kairos\\Periscope\\PeriscopeDesktop.exe"]
  [dns where
    dns.question.name :
    (
        "pastebin.*",
        "paste.ee",
        "ghostbin.com",
        "drive.google.com",
        "d.docs.live.net",
        "api.dropboxapi.*",
        "content.dropboxapi.*",
        "dl.dropboxusercontent.*",
        "api.onedrive.com",
        "*.onedrive.org",
        "onedrive.live.com",
        "filebin.net",
        "gofile.io",
        "*.ngrok.io",
        "file.io",
        "ngrok.com",
        "*.ngrok-free.app",
        "*.portmap.*",
        "*serveo.net",
        "*infinityfreeapp.com",
        "*localtunnel.me",
        "*pagekite.me",
        "*localxpose.io",
        "*notabug.org",
        "rawcdn.githack.*",
        "paste.nrecom.net",
        "zerobin.net",
        "controlc.com",
        "requestbin.net",
        "slack.com",
        "api.slack.com",
        "slack-redir.net",
        "slack-files.com",
        "cdn.discordapp.com",
        "discordapp.com",
        "discord.com",
        "discord.gg",
        "cdn.sql.gg",
        "cdn.discordapp.com",
        "www.uplooder.net",
        "*.cdnmegafiles.com",
        "transfer.sh",
        "updates.peer2profit.com",
        "api.telegram.org",
        "t.me",
        "bing.com",
        "yahoo.com",
        "meacz.gq",
        "rwrd.org", 
        "*.publicvm.com",
        "paste4btc.com",
        "api.notion.com",
        "*.sharepoint.com",
        "note.youdao.com",
        "mbasic.facebook.com",
        "api.gofile.io",
        "api.anonfiles.com",
        "api.gofile.io",
        "api.anonfiles.com",
        "api.trello.com",
        "api.notion.com",
        "gist.githubusercontent.com",
        "*.zulipchat.com",
        "filecloud.me",
        "i.ibb.co",
        "files.pythonhosted.org",
        "ip-api.com",
        "demo.ip-api.com",
          "checkip.dyndns.org",
          "api.ipify.org",
          "whatismyip.akamai.com",
          "bot.whatismyipaddress.com",
          "ifcfg.me",
          "ident.me",
          "ipof.in",
          "ip.tyk.nu",
          "icanhazip.com",
          "curlmyip.com",
          "wgetip.com",
          "eth0.me",
          "ipecho.net",
          "ip.appspot.com",
          "api.myip.com",
          "geoiptool.com",
          "api.2ip.ua",
          "api.ip.sb",
          "ipinfo.io",
          "checkip.amazonaws.com",
          "wtfismyip.com",
          "iplogger.*",
          "freegeoip.net",
          "freegeoip.app",
          "ipinfo.io",
          "geoplugin.net",
          "myip.dnsomatic.com",
          "www.geoplugin.net",
          "api64.ipify.org",
          "ip4.seeip.org",
          "*.geojs.io",
          "*portmap.io",
          "api.2ip.ua",
          "api.db-ip.com",
          "geolocation-db.com",
          "httpbin.org",
          "myip.opendns.com",
          "free.keep.sh",
          "tinyurl.com",
          "ftpupload.net",
          "cld.pt",
          "yandex.ru",
          "*.yandex.ru",
          "*.aternos.me",
          "geo.netsupportsoftware.com",
          "*.ngrok-free.app",
          "www.myexternalip.com",
          "cdn??.space",
          "steamcommunity.com",
          "*.netlify.app"
    ) and
  not (process.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe") and dns.question.name == "pastebin.com")
  ]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"


[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.10.0"