Attrib.exe Metasploit File Dropper (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Using attrib.exe, an adversary may display or change file attributes in order to bypass UAC restrictions. Metasploits file_dropper.rb, which is include in some payloads uses this to assist in removing artifacts

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564` Hide Artifacts

References

https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/file_dropper.rb

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: '5976.6321'
title: Attrib.exe Metasploit File Dropper
description: 'Using attrib.exe, an adversary may display or change file attributes
  in order to bypass UAC restrictions. Metasploits file_dropper.rb, which is include
  in some payloads uses this to assist in removing artifacts. -- Software Association:
  TargetCompany'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ("EventCode=4688" OR "<EventID>4688<")
  TERM(attrib) AND TERM(dll) | regex process="attrib.+?\.dll" | table _time, host,
  user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:hide artifacts
technique_id: 
- T1564
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/file_dropper.rb

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` ("EventCode=4688" OR "<EventID>4688<") TERM(attrib) AND TERM(dll)

Stage 2: `regex`

| regex process="attrib.+?\.dll"

Stage 3: `table`

| table _time, host, user parent_*, process, process_*, signature_id

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`process`	regex_match	`"attrib.+?.dll"` corpus 2 (splunk 2)	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"EventCode=4688"`
1	`"<EventID>4688<"`
1	`attrib`
1	`dll`