BitsAdmin NetCat PowerCat File Transfer (PowerShell)

id: '1067.1101'
title: BitsAdmin NetCat PowerCat File Transfer
description: 'This use case is searching for specific keywords that are generated
  when a file transfer using Bitsadmin, Netcat or PowerCat is made to send data to/from
  an external source. -- Threat Actor Association: Cadet Blizzard - Software Association:
  Black Basta -- Atomics T1105 Test #9'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (signature_id=4103 OR signature_id=4104)
  AND (" */transfer * * *" OR "-l *>" OR TERM(Start-BitsTransfer)) | rex field=_raw
  "(?i)user(\s+)?=(\s+)?(?<user>.+)" | rex field=process "(?i)(?<process>(.+/transfer.+)|(.+-l
  [^>]+>.+))" | rex field=process "(?i)(?<process_name>\S+)\s+(?<transfer>\/transfer)\s+(?<job_name>\S+)\s+(?<options>((\S+\s+)|(\/\S+\s+\S+\s+))+)?((?<remote_file>\S+)\s+(?<file_path>\S+))$(\s+)?"
  | rex field=process "([\.\\\]+)?"(?<process_name>"(?i)\S+")"\s+\-l\s+(-p\s+)?"(?<src_port>"\d+")"\s+(.+)?\>"(?<file_path>"\S+")
  | rex field=remote_file "(?<dest_ip>((25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9]))"
  | rex field=file_path mode=sed "s/''(.+)''/\1/"| eval options=mvappend(transfer."
  ".job_name,options) | fillnull value="false" transfer dest_ip | table _time, host,
  user dest_ip file_path job_name options process process_name process_path remote_file
  signature_id src_port user user_id transfer| bin span=1s | stats values(*) as *
  by _time, host | where isnotnull(process_name) | iplocation prefix=dest_ dest_ip|
  lookup dnslookup clientip as dest_ip OUTPUT clienthost as dest_dns '
techniques:
- command-and-control:application layer protocol:file transfer protocols
- persistence:bits jobs
- defense-evasion:bits jobs
technique_id:
- T1071.002
- T1197
data_category:
- PowerShell logs
- Process command-line parameters
references: null