Detection rules › Splunk

Go Run Execution (Sysmon)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Malicious actors are beginning to turn to Golang as a malware language since it is not typically picked up by antivirus software. Although the language is about 10 years old, and is used by many legitimate programmers, there has not been as much activity with Golang malware. This use case looks for run executions by go.

MITRE ATT&CK coverage

References

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

id: '6091.18333'
title: Go Run Execution
description: Malicious actors are beginning to turn to Golang as a malware language
  since it is not typically picked up by antivirus software. Although the language
  is about 10 years old, and is used by many legitimate programmers, there has not
  been as much activity with Golang malware. This use case looks for run executions
  by go.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(GO) OR "go.exe") TERM(RUN) | rex field=process (?<ioc>"(?i)\S+\.go") | table
  _time, host, user, signature_id, process, process_*, parent_process_* ioc | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows Sysmon
references:
- https://www.f5.com/labs/articles/threat-intelligence/new-golang-malware-is-spreading-via-multiple-exploits-to-mine-mo

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") (TERM(GO) OR "go.exe") TERM(RUN)

Stage 2: rex

| rex field=process (?<ioc>"(?i)\S+\.go")

Stage 3: table

| table _time, host, user, signature_id, process, process_*, parent_process_* ioc

Stage 4: bucket

| bin span=1s

Stage 5: stats

| stats values(*) as * by _time, host

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 1 corpus 237 (splunk 224, kusto 13)

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1TERM
1"<EventID>1<"
1TERM
1GO
1"go.exe"
1TERM
1RUN