Detection rules › Splunk
Access Common Package Config file (PowerShell)
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. An Adversary with access could identify or modify configuration of packages in order to execute code and evade defenses.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546 Event Triggered Execution |
| Privilege Escalation | T1546 Event Triggered Execution |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
id: '5986.6348'
title: Access Common Package Config file
description: 'Adversaries may establish persistence and/or elevate privileges using
system mechanisms that trigger execution based on specific events. An Adversary
with access could identify or modify configuration of packages in order to execute
code and evade defenses. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(vi)
OR TERM(vim) OR TERM(nano) OR TERM(visudo) OR TERM(edit) OR (TERM(copy) TERM(con))
OR TERM(cat) OR TERM(more) OR TERM(gc) OR TERM(get-Content) OR TERM(type) OR ">>"
OR ">") ("requirements.txt" OR "pip.conf" OR "package.json" OR "gemspec" OR "gemrc")
| regex process="(?i)(vi|vim|nano|visudo|edit|copy\s+con|cat|more|gc|get-content|type|\>\>|\>)\s+.+(requirements\.txt|pip\.conf|package.json|\.gemspec|gemrc)"
| table _time, host, user, process, process_*, signature_id | bin span=1s | stats
values(*) as * by _time, host '
techniques:
- persistence:event triggered execution
- privilege-escalation:event triggered execution
technique_id:
- T1546
data_category:
- Process command-line parameters
- PowerShell logs
references:
- https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(vi) OR TERM(vim) OR TERM(nano) OR TERM(visudo) OR TERM(edit) OR (TERM(copy) TERM(con)) OR TERM(cat) OR TERM(more) OR TERM(gc) OR TERM(get-Content) OR TERM(type) OR ">>" OR ">") ("requirements.txt" OR "pip.conf" OR "package.json" OR "gemspec" OR "gemrc")
Stage 2: regex
| regex process="(?i)(vi|vim|nano|visudo|edit|copy\s+con|cat|more|gc|get-content|type|\>\>|\>)\s+.+(requirements\.txt|pip\.conf|package.json|\.gemspec|gemrc)"
Stage 3: table
| table _time, host, user, process, process_*, signature_id
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | TERM |
| 1 | vi |
| 1 | TERM |
| 1 | vim |
| 1 | TERM |
| 1 | nano |
| 1 | TERM |
| 1 | visudo |
| 1 | TERM |
| 1 | edit |
| 1 | TERM |
| 1 | copy |
| 1 | TERM |
| 1 | con |
| 1 | TERM |
| 1 | cat |
| 1 | TERM |
| 1 | more |
| 1 | TERM |
| 1 | gc |
| 1 | "get-Content" |
| 1 | TERM |
| 1 | type |
| 1 | ">>" |
| 1 | ">" |
| 1 | "requirements.txt" |
| 1 | "pip.conf" |
| 1 | "package.json" |
| 1 | "gemspec" |
| 1 | "gemrc" |