Detection rules › Splunk
Meterpreter Reverse Shell (Windows Event Log)
Detects the Metasploit Meterpreter establishing a reverse shell on a target system. This exploit was most commonly used in threats such as the EternalBlue exploit and the WannaCry outbreak
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell, T1059.003 Command and Scripting Interpreter: Windows Command Shell |
| Lateral Movement | T1570 Lateral Tool Transfer |
| Command & Control | T1095 Non-Application Layer Protocol |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4625 | An account failed to log on. |
| Security-Auditing | Event ID 5140 | A network share object was accessed. |
| Security-Auditing | Event ID 5156 | The Windows Filtering Platform has permitted a connection. |
Rule body yaml
id: '1010.1013'
title: Meterpreter Reverse Shell
description: 'Detects the Metasploit Meterpreter establishing a reverse shell on a
target system. This exploit was most commonly used in threats such as the EternalBlue
exploit and the WannaCry outbreak - Threat Actor Association: APT43, FIN10, Earth
Estries, Flax Typhoon, Hydrochasma, Kimsuky, Volt Typhoon - Software Association:
BumbleBee, Clop, Conti, Cuba, Dridex, Entropy, Play, TargetCompany, WannaCry'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` AND ((TERM(EventCode=5156)
OR "<EventID>5156<") AND TERM(4) AND (TERM("%%14592") OR TERM(inbound)) AND TERM(6)
AND (TERM("%%14610") OR TERM("Receive/Accept")) AND TERM(44)) OR(TERM(EventCode=5140)
OR "<EventID>5140<") OR((TERM(EventCode=4625) OR "<EventID>4625<") AND (TERM("%%2313")
OR TERM("Unknown user name or bad password.")) AND TERM(3) AND TERM(NtLmSsp) AND
TERM(NTLM))|regex "(?i)(Process ID:(\s+)?4[^\d])|share|ntlm" | table _time, host,
user dest_ip, dest_port, direction, dvc, dvc_nt_host, event_id, host, index, parent_process_id,
process, process_id, process_name, process_path, signature_id, source, sourcetype,
src_ip, src_port, tag, user | transaction dvc startswith="signature_id=5156" maxspan=30s
| where like(signature_id,"5156") AND like(signature_id,"4625") AND like(signature_id,"5140") '
techniques:
- execution:command and scripting interpreter
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter:windows command shell
- lateral-movement:lateral tool transfer
- command-and-control:non-application layer protocol
technique_id:
- T1059
- T1059.001
- T1059.003
- T1570
- T1095
data_category:
- Windows event logs
references:
- https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` AND ((TERM(EventCode=5156) OR "<EventID>5156<") AND TERM(4) AND (TERM("%%14592") OR TERM(inbound)) AND TERM(6) AND (TERM("%%14610") OR TERM("Receive/Accept")) AND TERM(44)) OR(TERM(EventCode=5140) OR "<EventID>5140<") OR((TERM(EventCode=4625) OR "<EventID>4625<") AND (TERM("%%2313") OR TERM("Unknown user name or bad password.")) AND TERM(3) AND TERM(NtLmSsp) AND TERM(NTLM))
Stage 2: regex
| regex "(?i)(Process ID:(\s+)?4[^\d])|share|ntlm"
Stage 3: table
| table _time, host, user dest_ip, dest_port, direction, dvc, dvc_nt_host, event_id, host, index, parent_process_id, process, process_id, process_name, process_path, signature_id, source, sourcetype, src_ip, src_port, tag, user
Stage 4: transaction
| transaction dvc startswith="signature_id=5156" maxspan=30s
Stage 5: where
| where like(signature_id,"5156") AND like(signature_id,"4625") AND like(signature_id,"5140")
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
_raw | regex_match |
|
signature_id | like |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>5156<" |
| 1 | TERM |
| 1 | 4 |
| 1 | "%%14592" |
| 1 | TERM |
| 1 | inbound |
| 1 | TERM |
| 1 | 6 |
| 1 | "%%14610" |
| 1 | "Receive/Accept" |
| 1 | TERM |
| 1 | 44 |
| 1 | TERM |
| 1 | "<EventID>5140<" |
| 1 | TERM |
| 1 | "<EventID>4625<" |
| 1 | "%%2313" |
| 1 | "Unknown user name or bad password." |
| 1 | TERM |
| 1 | 3 |
| 1 | TERM |
| 1 | NtLmSsp |
| 1 | TERM |
| 1 | NTLM |