BitsAdmin NetCat PowerCat File Transfer (Sysmon)

id: '1067.1100'
title: BitsAdmin NetCat PowerCat File Transfer
description: 'This use case is searching for specific keywords that are generated
  when a file transfer using Bitsadmin, Netcat or PowerCat is made to send data to/from
  an external source. -- Threat Actor Association: Cadet Blizzard - Software Association:
  Black Basta -- Atomics T1105 Test #9'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (("/transfer" OR "/addfile" OR "Start-BitsTransfer" OR " -vw " OR " -vn " OR " -vwn
  " OR " -vnw " OR " -w " OR " -wv " OR " -wn " OR " -wvn " OR " -wnv " OR " -N "
  OR " -Nv " OR " -Nw " OR " -Nvw " OR " -Nwv " OR " --send-only") OR ("nc64" OR "nc32"
  OR "netcat64" OR "netcat32" OR "ncat" OR "nc" OR "netcat")) | regex process="(\s+\-[Nvw]+\s+\d+?.*?(((\d{1,3}\.){3}\d{1,3})|(\w?\wtps?\:(\/\/|\x5c\x5c)))\s+\d{2,5})|(?i)((ncat|nc|nc64|nc32|netcat64|netcat32|netcat)(\s+|\.exe).*?\-[Nvw]+\s+\d+?.*?(((\d{1,3}\.){3}\d{1,3})|(\w?\wtps?\:(\/\/|\x5c\x5c)))\s+\d{2,5})|(\s+\/(transfer)\s+.*?\w{3,5}\:\/\/)|(?i)(--send-only\s+?$)|(?i)(Start-BitsTransfer)|\s+(\/(addfile)\s+)"
  | rex field=process max_match=1 (?<dest_ip>"\s+((([a-f0-9:]+:+)+[a-f0-9]+)|((\d{1,3}\.){3}\d{1,3}))\s+")|
  rex field=dest_ip mode=sed "s/([\n|\r|\s])//g" | table _time, host, user process,
  process_*, parent_*, dest_ip | bin span=1s | stats values(*) as * by _time, host
  | search NOT dest_ip IN(10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12,
  192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1", "FE80::/10", "FF00::/8") '
techniques:
- command-and-control:application layer protocol:file transfer protocols
- persistence:bits jobs
- defense-evasion:bits jobs
technique_id:
- T1071.002
- T1197
data_category:
- Windows Sysmon
references: null