Detection rules › Splunk
Bash -c Execution - Windows (Sysmon)
Bash is a popular default shell on Linux and macOS. Git Bash is a package that installs Bash, some common bash utilities, and Git on a Windows operating system. Bash is also included with Windows Subsystem for Linux. Bash is on the Microsoft recommended block list for executable files. This use case detects executions of bash.exe with -c.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '33144.58803'
title: Bash -c Execution - Windows
description: Bash is a popular default shell on Linux and macOS. Git Bash is a package
that installs Bash, some common bash utilities, and Git on a Windows operating system.
Bash is also included with Windows Subsystem for Linux. Bash is on the Microsoft
recommended block list for executable files. This use case detects executions of
bash.exe with -c.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"bash.exe" | regex process_name="(?i)bash\.exe"| regex process="(?i)\s+-[ilsx]*c[ilsx]*"
| table _time, host, user, signature_id, process, process_*, parent_process_* |
bin span=1s | stats values(*) as * by _time, host | where event_count < 5 '
techniques:
- defense-evasion:system binary proxy execution
- defense-evasion:system script proxy execution
technique_id:
- T1218
- T1216
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Bash/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "bash.exe"
Stage 2: regex
| regex process_name="(?i)bash\.exe"
Stage 3: regex
| regex process="(?i)\s+-[ilsx]*c[ilsx]*"
Stage 4: table
| table _time, host, user, signature_id, process, process_*, parent_process_*
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host
Stage 7: where
| where event_count < 5
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"1" |
event_count | lt |
| field:"event_count" kind:lt value:"5" |
process | regex_match |
| field:"CommandLine" kind:regex_match |
process_name | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>1<" |
| 1 | "bash.exe" |