Data Staged to File (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. This use case looks for common output commands followed by a potential file extension

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1074.001` Data Staged: Local Data Staging

References

https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '5691.6112'
title: Data Staged to File
description: 'Adversaries may stage collected data in a central location or directory
  on the local system prior to Exfiltration. Data may be kept in separate files or
  combined into one file through techniques such as Archive Collected Data. This use
  case looks for common output commands followed by a potential file extension. --
  Threat Actor Association: Actinium/Gamaredon/Primitive Bear, APT29/Nobelium, APT37,
  Arid Viper/APT C-23, Gorgon Group, Kimsuky, Memento Team, Wizard Spider, WIRTE --
  Software Association: Bazar, Conti, Remcos - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104)| regex
  Message="(?i)\s(\>(\>)?|Out\-File)\s.{1,}\.\w{2,5}" | table _time, host, user signature_id,
  process, process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
technique_id:
- T1074.001
data_category:
- Process command-line parameters
- Linux audit logs
- PowerShell logs
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104)

Stage 2: `regex`

| regex Message="(?i)\s(\>(\>)?|Out\-File)\s.{1,}\.\w{2,5}"

Stage 3: `table`

| table _time, host, user signature_id, process, process_name

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`
`Message`	regex_match	`"(?i)\s(\>(\>)?\|Out\-File)\s.{1,}.\w{2,5}"`	`field:"Message" kind:regex_match`