Detection rules › Splunk
Go Run Execution
Malicious actors are beginning to turn to Golang as a malware language since it is not typically picked up by antivirus software. Although the language is about 10 years old, and is used by many legitimate programmers, there has not been as much activity with Golang malware. This use case looks for run executions by go.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
References
Telemetry coverage
Rule body
id: '6091.6541'
title: Go Run Execution
description: Malicious actors are beginning to turn to Golang as a malware language
since it is not typically picked up by antivirus software. Although the language
is about 10 years old, and is used by many legitimate programmers, there has not
been as much activity with Golang malware. This use case looks for run executions
by go.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type=execve OR type=proctitle
OR sourcetype=bash_history) TERM(GO) TERM(RUN) | rex field=_raw "(?i)proctitle\=(?<command_type>.+)"|
eval process=mvappend(process, command_type)| fields - command_type | where isnotnull(process)
| table _time, host, user process | bin span=1s | stats values(*) as * by _time,
host '
techniques:
- execution:command and scripting interpreter
technique_id:
- T1059
data_category:
- Process command-line parameters
references:
- https://www.f5.com/labs/articles/threat-intelligence/new-golang-malware-is-spreading-via-multiple-exploits-to-mine-mo
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_unix` (type=execve OR type=proctitle OR sourcetype=bash_history) TERM(GO) TERM(RUN)
Stage 2: rex
| rex field=_raw "(?i)proctitle\=(?<command_type>.+)"
Stage 3: eval
| eval process=mvappend(process, command_type)
Stage 4: fields
| fields - command_type
Stage 5: where
| where isnotnull(process)
Stage 6: table
| table _time, host, user process
Stage 7: bucket
| bin span=1s
Stage 8: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
process | is_not_null | field:"CommandLine" kind:is_not_null | |
sourcetype | eq |
| field:"sourcetype" kind:eq value:"bash_history" |
type | eq |
| field:"type" kind:eq |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | GO |
| 1 | RUN |