Automated Collection Command Prompt

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1552.001` Unsecured Credentials: Credentials In Files
Collection	`T1119` Automated Collection

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Automated Collection Command Prompt
id: f576a613-2392-4067-9d1a-9345fb58d8d1
status: test
description: Once established within a system or network, an adversary may use automated techniques for collecting internal data.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
author: frack113
date: 2021-07-28
modified: 2022-11-11
tags:
    - attack.collection
    - attack.t1119
    - attack.credential-access
    - attack.t1552.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_ext:
        CommandLine|contains:
            - '.doc'
            - '.docx'
            - '.xls'
            - '.xlsx'
            - '.ppt'
            - '.pptx'
            - '.rtf'
            - '.pdf'
            - '.txt'
    selection_other_dir:
        CommandLine|contains|all:
            - 'dir '
            - ' /b '
            - ' /s '
    selection_other_findstr:
        OriginalFileName: 'FINDSTR.EXE'
        CommandLine|contains:
            - ' /e '
            - ' /si '
    condition: selection_ext and 1 of selection_other_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection_ext and 1 of selection_other_*

Stage 1: `selection_ext`

selection_ext:
    CommandLine|contains:
        - '.doc'
        - '.docx'
        - '.xls'
        - '.xlsx'
        - '.ppt'
        - '.pptx'
        - '.rtf'
        - '.pdf'
        - '.txt'

Stage 2: `selection_other_dir`

selection_other_dir:
    CommandLine|contains|all:
        - 'dir '
        - ' /b '
        - ' /s '

Stage 3: `selection_other_findstr`

selection_other_findstr:
    OriginalFileName: 'FINDSTR.EXE'
    CommandLine|contains:
        - ' /e '
        - ' /si '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/b` `/e` corpus 3 (sigma 3) `/s` corpus 6 (sigma 3, splunk 3) `/si` `.doc` corpus 4 (sigma 4) `.docx` `.pdf` corpus 3 (sigma 3) `.ppt` corpus 4 (sigma 4) `.pptx` `.rtf` corpus 2 (sigma 2) `.txt` corpus 9 (sigma 9) `.xls` corpus 4 (sigma 4) `.xlsx` `dir` corpus 8 (sigma 5, splunk 2, chronicle 1)	`field:"CommandLine" kind:match`
`OriginalFileName`	eq	`FINDSTR.EXE` corpus 12 (sigma 12)	`field:"OriginalFileName" kind:eq value:"FINDSTR.EXE"`

Automated Collection Command Prompt

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_ext

Stage 2: selection_other_dir

Stage 3: selection_other_findstr

Indicators

Stage 0: `condition`

Stage 1: `selection_ext`

Stage 2: `selection_other_dir`

Stage 3: `selection_other_findstr`