detection.wiki

Detection rules › Sigma

Potential Data Exfiltration Activity Via CommandLine Tools

Status
test
Severity
high
Log source
category process_creation, product windows
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the use of various CLI utilities exfiltrating data via web requests

Known false positives

  • Unlikely

MITRE ATT&CK coverage

TacticTechniques
Execution

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation
Security-AuditingEvent ID 4688: A new process has been created.

Rule body

title: Potential Data Exfiltration Activity Via CommandLine Tools
id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab
status: test
description: Detects the use of various CLI utilities exfiltrating data via web requests
references:
    - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-02
modified: 2025-10-19
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_iwr:
        Image|endswith:
            - '\powershell_ise.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'curl '
            - 'Invoke-RestMethod'
            - 'Invoke-WebRequest'
            - 'irm '
            - 'iwr '
            - 'wget '
        CommandLine|contains|all:
            - ' -ur' # Shortest possible version of the -uri flag
            - ' -me' # Shortest possible version of the -method flag
            - ' -b'
            - ' POST '
    selection_curl:
        Image|endswith: '\curl.exe'
        CommandLine|contains: '--ur' # Shortest possible version of the --uri flag
    selection_curl_data:
        CommandLine|contains:
            - ' -d ' # Shortest possible version of the --data flag
            - ' --data '
    selection_wget:
        Image|endswith: '\wget.exe'
        CommandLine|contains:
            - '--post-data'
            - '--post-file'
    payloads:
        - CommandLine|re:
              - 'net\s+view'
              - 'sc\s+query'
        - CommandLine|contains:
              - 'Get-Content'
              - 'GetBytes'
              - 'hostname'
              - 'ifconfig'
              - 'ipconfig'
              - 'netstat'
              - 'nltest'
              - 'qprocess'
              - 'systeminfo'
              - 'tasklist'
              - 'ToBase64String'
              - 'whoami'
        - CommandLine|contains|all:
              - 'type '
              - ' > '
              - ' C:\'
    condition: (selection_iwr or all of selection_curl* or selection_wget) and payloads
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

(selection_iwr or all of selection_curl* or selection_wget) and payloads

Stage 1: selection_iwr

selection_iwr:
    Image|endswith:
        - '\powershell_ise.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\cmd.exe'
    CommandLine|contains:
        - 'curl '
        - 'Invoke-RestMethod'
        - 'Invoke-WebRequest'
        - 'irm '
        - 'iwr '
        - 'wget '
    CommandLine|contains|all:
        - ' -ur'
        - ' -me'
        - ' -b'
        - ' POST '

Stage 2: selection_curl

selection_curl:
    Image|endswith: '\curl.exe'
    CommandLine|contains: '--ur'

Stage 3: selection_curl_data

selection_curl_data:
    CommandLine|contains:
        - ' -d '
        - ' --data '

Stage 4: selection_wget

selection_wget:
    Image|endswith: '\wget.exe'
    CommandLine|contains:
        - '--post-data'
        - '--post-file'

Stage 5: payloads

payloads:
    - CommandLine|re:
          - 'net\s+view'
          - 'sc\s+query'
    - CommandLine|contains:
          - 'Get-Content'
          - 'GetBytes'
          - 'hostname'
          - 'ifconfig'
          - 'ipconfig'
          - 'netstat'
          - 'nltest'
          - 'qprocess'
          - 'systeminfo'
          - 'tasklist'
          - 'ToBase64String'
          - 'whoami'
    - CommandLine|contains|all:
          - 'type '
          - ' > '
          - ' C:\'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • --data corpus 3 (sigma 3)
  • -b
  • -d corpus 8 (sigma 7, splunk 1)
  • -me
  • -ur corpus 3 (sigma 2, chronicle 1)
  • > corpus 5 (sigma 5)
  • C:\ corpus 2 (sigma 2)
  • POST
  • --post-data
  • --post-file
  • --ur
  • Get-Content corpus 2 (sigma 2)
  • GetBytes
  • Invoke-RestMethod corpus 5 (sigma 5)
  • Invoke-WebRequest corpus 15 (sigma 10, elastic 3, chronicle 1, kusto 1)
  • ToBase64String
  • curl corpus 17 (sigma 11, elastic 5, chronicle 1)
  • hostname corpus 3 (sigma 1, elastic 1, splunk 1)
  • ifconfig corpus 2 (sigma 2)
  • ipconfig corpus 4 (sigma 3, kusto 1)
  • irm corpus 5 (sigma 5)
  • iwr corpus 13 (sigma 11, chronicle 2)
  • netstat corpus 2 (sigma 2)
  • nltest corpus 2 (sigma 2)
  • qprocess
  • systeminfo corpus 6 (sigma 4, splunk 1, kusto 1)
  • tasklist corpus 5 (sigma 5)
  • type corpus 6 (sigma 6)
  • wget corpus 13 (sigma 7, elastic 5, chronicle 1)
  • whoami corpus 16 (sigma 9, elastic 4, splunk 2, kusto 1)
field:"CommandLine" kind:match
CommandLineregex_match
  • net\s+view
  • sc\s+query
field:"CommandLine" kind:regex_match
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \curl.exe corpus 31 (sigma 31)
  • \powershell.exe corpus 179 (sigma 178, kusto 1)
  • \powershell_ise.exe corpus 41 (sigma 41)
  • \pwsh.exe corpus 165 (sigma 164, kusto 1)
  • \wget.exe corpus 9 (sigma 9)
field:"Image" kind:ends_with