Certutil File Download (Sysmon)

Group by: _time, command_line, host
Source: github.com/anvilogic-forge/armory

There are attack scenarios in which attackers download different tools or scripts in order to take full control over certain machines. For example, an attacker gets a reverse shell on the target but is a low privileged shell. In this situation, the attacker can download different exploits on the target for privilege escalation using tools such as wget

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1027` Obfuscated Files or Information
Command & Control	`T1105` Ingress Tool Transfer

References

https://www.ired.team/offensive-security/defense-evasion/downloading-file-with-certutil

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '5327.5689'
title: Certutil File Download
description: 'There are attack scenarios in which attackers download different tools
  or scripts in order to take full control over certain machines. For example, an
  attacker gets a reverse shell on the target but is a low privileged shell. In this
  situation, the attacker can download different exploits on the target for privilege
  escalation using tools such as wget. -- Threat Actor Association: APT41, DarkSide,
  BlackMatter, APT31, Flax Typhoon, Wizard Spider - Software Association: ALPHV/BlackCat,
  Babuk, Bazar, Conti -- Atomics T1027 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 TERM("certutil")
  | where match (process, "(?i)(\w?\wtps?\:(\/\/|\x5c\x5c))|\:\/\/") OR (match(process_name,
  "(?i)certutil") AND match(process, "(?i)u.*?r.*?l.*?c.*?a.*?c.*?h.*?e")) | table
  _time, host, user, signature_id, process, process_*, parent_process, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host, process '
techniques:
- command-and-control:ingress tool transfer
- defense-evasion:obfuscated files or information
technique_id: 
- T1105
- T1027
data_category:
- Windows Sysmon
references:
- https://www.ired.team/offensive-security/defense-evasion/downloading-file-with-certutil

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 TERM("certutil")

Stage 2: `where`

| where match (process, "(?i)(\w?\wtps?\:(\/\/|\x5c\x5c))|\:\/\/") OR (match(process_name, "(?i)certutil") AND match(process, "(?i)u.*?r.*?l.*?c.*?a.*?c.*?h.*?e"))

Stage 3: `table`

| table _time, host, user, signature_id, process, process_*, parent_process, parent_process_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host, process

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process`	regex_match	`"(?i)(\w?\wtps?\:(\/\/\|\x5c\x5c))` `\:\/\/"` corpus 2 (splunk 2) `"(?i)u.?r.?l.?c.?a.?c.?h.*?e"` corpus 2 (splunk 2)	`field:"CommandLine" kind:regex_match`
`process_name`	regex_match	`"(?i)certutil"` corpus 4 (splunk 4)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"certutil"`