Native Archive Commands (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1074.001` Data Staged: Local Data Staging `T1560` Archive Collected Data

References

https://liberty-shell.com/sec/2019/11/06/living-off-the-land-pt2/

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '5525.5749'
title: Native Archive Commands
description: 'An adversary may compress and/or encrypt data that is collected prior
  to exfiltration. Compressing the data can help to obfuscate the collected data and
  minimize the amount of data sent over the network. - Threat Actor Association: APT28
  (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM),
  APT29/Nobelium/Cozy Bear, APT33, Conti, DarkSide, BlackMatter, FIN7, Karakurt, MuddyWater,
  TA428, Volt Typhoon, Witchetty - Software Association: Black Basta, NanoCore, Ransom
  Cartel, SquirrelWaffle - Atomics T1074.001 Test#3 Atomics T1560 Test#1 Atomics T1560.001
  Test #5 Atomics T1560.001 Test #6 Atomics T1560.001 Test #7 Atomics T1560.001 Test
  #8 Atomics T1560.001 Test #9 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(Compress-Archive)
  OR TERM(tar) OR TERM(makecab) OR TERM(compact.exe) OR TERM(compact) OR (TERM(Compression)
  TERM(System) TERM(IO))) | regex process!="(Decompress)" | regex process="(?i)Compress-Archive|tar|makecab|compact|System\.IO\.Compression"
  | table _time, host, user signature_id, process, process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
- collection:archive collected data
technique_id:
- T1074.001
- T1560
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://liberty-shell.com/sec/2019/11/06/living-off-the-land-pt2/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(Compress-Archive) OR TERM(tar) OR TERM(makecab) OR TERM(compact.exe) OR TERM(compact) OR (TERM(Compression) TERM(System) TERM(IO)))

Stage 2: `regex`

| regex process!="(Decompress)"

Stage 3: `regex`

| regex process="(?i)Compress-Archive|tar|makecab|compact|System\.IO\.Compression"

Stage 4: `table`

| table _time, host, user signature_id, process, process_*

Stage 5: `bucket`

| bin span=1s

Stage 6: `stats`

| stats values(*) as * by _time, host

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`process`	regex_match	`"(Decompress)"`	`excludes:process`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`
`process`	regex_match	`"(?i)Compress-Archive` `tar` `makecab` `compact` `System.IO.Compression"`	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"Compress-Archive"`
1	`tar`
1	`makecab`
1	`compact.exe`
1	`compact`
1	`Compression`
1	`System`
1	`IO`