detection.wiki

Detection rules › Sigma

PUA - Netcat Suspicious Execution

Status
test
Severity
high
Log source
product windows, category process_creation
Author
frack113, Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1095 Non-Application Layer Protocol

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: PUA - Netcat Suspicious Execution
id: e31033fc-33f0-4020-9a16-faf9b31cbf08
status: test
description: Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
references:
    - https://nmap.org/ncat/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
    - https://www.revshells.com/
author: frack113, Florian Roth (Nextron Systems)
date: 2021-07-21
modified: 2023-02-08
tags:
    - attack.command-and-control
    - attack.t1095
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        # can not use OriginalFileName as is empty
        Image|endswith:
            - '\nc.exe'
            - '\ncat.exe'
            - '\netcat.exe'
    selection_cmdline:
        # Typical command lines
        CommandLine|contains:
            - ' -lvp '
            - ' -lvnp'
            - ' -l -v -p '
            - ' -lv -p '
            - ' -l --proxy-type http '
            # - ' --exec cmd.exe ' # Not specific enough for netcat
            - ' -vnl --exec '
            - ' -vnl -e '
            - ' --lua-exec '
            - ' --sh-exec '
    condition: 1 of selection_*
falsepositives:
    - Legitimate ncat use
level: high

Stages and Predicates

Stage 0: condition

1 of selection_*

Stage 1: selection_img

selection_img:
    Image|endswith:
        - '\nc.exe'
        - '\ncat.exe'
        - '\netcat.exe'

Stage 2: selection_cmdline

selection_cmdline:
    CommandLine|contains:
        - ' -lvp '
        - ' -lvnp'
        - ' -l -v -p '
        - ' -lv -p '
        - ' -l --proxy-type http '
        - ' -vnl --exec '
        - ' -vnl -e '
        - ' --lua-exec '
        - ' --sh-exec '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • --lua-exec
  • --sh-exec
  • -l --proxy-type http
  • -l -v -p
  • -lv -p
  • -lvnp
  • -lvp
  • -vnl --exec
  • -vnl -e
Imageends_with
  • \nc.exe
  • \ncat.exe
  • \netcat.exe