detection.wiki

Detection rules › Sigma

Silence.EDA Detection

Status
test
Severity
critical
Log source
category ps_script, product windows
Author
Alina Stepchenkova, Group-IB, oscd.community
Source
github.com/SigmaHQ/sigma

Detects Silence EmpireDNSAgent as described in the Group-IP report

MITRE ATT&CK coverage

TacticTechniques
Execution
Command & Control
Impact

Telemetry coverage

ProviderRecord / event type
PowerShellEvent ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Silence.EDA Detection
id: 3ceb2083-a27f-449a-be33-14ec1b7cc973
status: test
description: Detects Silence EmpireDNSAgent as described in the Group-IP report
references:
    - https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
author: Alina Stepchenkova, Group-IB, oscd.community
date: 2019-11-01
modified: 2023-04-03
tags:
    - attack.execution
    - attack.t1059.001
    - attack.command-and-control
    - attack.t1071.004
    - attack.t1572
    - attack.impact
    - attack.t1529
    - attack.g0091
    - attack.s0363
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    empire:
        # better to randomise the order
        ScriptBlockText|contains|all:
            - 'System.Diagnostics.Process'
            - 'Stop-Computer'
            - 'Restart-Computer'
            - 'Exception in execution'
            - '$cmdargs'
            - 'Close-Dnscat2Tunnel'
    dnscat:
        # better to randomise the order
        ScriptBlockText|contains|all:
            - 'set type=$LookupType`nserver'
            - '$Command | nslookup 2>&1 | Out-String'
            - 'New-RandomDNSField'
            - '[Convert]::ToString($SYNOptions, 16)'
            - '$Session.Dead = $True'
            - '$Session["Driver"] -eq'
    condition: empire and dnscat
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: condition

empire and dnscat

Stage 1: empire

empire:
    ScriptBlockText|contains|all:
        - 'System.Diagnostics.Process'
        - 'Stop-Computer'
        - 'Restart-Computer'
        - 'Exception in execution'
        - '$cmdargs'
        - 'Close-Dnscat2Tunnel'

Stage 2: dnscat

dnscat:
    ScriptBlockText|contains|all:
        - 'set type=$LookupType`nserver'
        - '$Command | nslookup 2>&1 | Out-String'
        - 'New-RandomDNSField'
        - '[Convert]::ToString($SYNOptions, 16)'
        - '$Session.Dead = $True'
        - '$Session["Driver"] -eq'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ScriptBlockTextmatch
  • $Command | nslookup 2>&1 | Out-String
  • $Session.Dead = $True
  • $Session["Driver"] -eq
  • $cmdargs
  • Close-Dnscat2Tunnel
  • Exception in execution
  • New-RandomDNSField
  • Restart-Computer
  • Stop-Computer
  • System.Diagnostics.Process
  • [Convert]::ToString($SYNOptions, 16)
  • set type=$LookupType`nserver
field:"ScriptBlockText" kind:match