Detection rules › Splunk
Compressed File Execution (Windows Event Log)
This use case looks for the execution of compressed executable
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
id: '7831.9438'
title: Compressed File Execution
description: 'This use case looks for the execution of compressed executable. Threat
Actor Association: APT-K-47/Mysterious Elephant, APT10/menuPass, APT36, APT37, Gamaredon
Group/Shuckworm, Magnat, MuddyWater, InvisiMole, SideWinder, TA402, TA416, TA551,
TA576, UAC-0057 (GhostWriter), UNC2589 - Software Association: Agent Tesla, ALPHV/Blackcat,
Bazarloader, Black Basta, Bumblebee Loader, Clop, Conti, DatopLoader, DarkCrystal
RAT, Emotet, Lockbit, NimbleMamba, PureCrypter, Qakbot/Qbot, Quantum, Remcos RAT,
Ursnif, Vidar Stealer - Atomics T1027 Test #4 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) (".zip" ".exe") | table _time, host, user process,
process_*, signature_id, parent_* | bin span=1s | stats values(*) as * by _time,
host | where match(process_path,"(?i)\.zip\x5c.*?\.exe") OR match(parent_process_path,"(?i)\.zip\x5c.*?\.exe") '
techniques:
- defense-evasion:obfuscated files or information
technique_id:
- T1027
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (".zip" ".exe")
Stage 2: table
| table _time, host, user process, process_*, signature_id, parent_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: where
| where match(process_path,"(?i)\.zip\x5c.*?\.exe") OR match(parent_process_path,"(?i)\.zip\x5c.*?\.exe")
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4688" |
parent_process_path | regex_match |
| field:"parent_process_name" kind:regex_match |
process_path | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4688<" |
| 1 | ".zip" |
| 1 | ".exe" |