Detection rules › Splunk
Output to File (PowerShell)
Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. This use case looks for indicators of commands being saved to a file such as ">" or ">>". Typically a new process is not created when executed from a command prompt, however adversaries may output process results to a txt document during discovery
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.003 Command and Scripting Interpreter: Windows Command Shell |
| Stealth | T1036 Masquerading |
| Collection | T1074.001 Data Staged: Local Data Staging |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
id: '6144.6642'
title: Output to File
description: 'Adversaries may stage collected data in a central location or directory
on the local system prior to Exfiltration. This use case looks for indicators of
commands being saved to a file such as ">" or ">>". Typically a new process
is not created when executed from a command prompt, however adversaries may output
process results to a txt document during discovery. -- Threat Actor Association:
Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
OilRig, TeamTNT - Software Association: Bazar, Clop, Conti, DarkWatchman, EagleEye,
Hive, Koxic, Polyglot, SysJoker Atomics T1059.003 Test #2 Atomics T1059.003 Test
#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
TERM(EventCode=4104) OR "<EventID>4103<" OR "<EventID>4104<")(TERM(Out-File) OR
TERM(>) OR ">>") | regex process="(?i)(\s+|\;|\:\,|\d+|\|)(out-file|\>{1,2})(\s|\;|\:\,\|).{1,}"
| table _time, host, user, signature_id, process_name, user, process | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
- defense-evasion:masquerading
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1074.001
- T1036
- T1059.003
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR TERM(EventCode=4104) OR "<EventID>4103<" OR "<EventID>4104<")(TERM(Out-File) OR TERM(>) OR ">>")
Stage 2: regex
| regex process="(?i)(\s+|\;|\:\,|\d+|\|)(out-file|\>{1,2})(\s|\;|\:\,\|).{1,}"
Stage 3: table
| table _time, host, user, signature_id, process_name, user, process
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | TERM |
| 1 | "<EventID>4103<" |
| 1 | "<EventID>4104<" |
| 1 | "Out-File" |
| 1 | ">" |
| 1 | ">>" |