Detection rules › Splunk
Output to File (Windows Event Log)
Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. This use case looks for indicators of commands being saved to a file such as ">" or ">>". Typically a new process is not created when executed from a command prompt, however adversaries may output process results to a txt document during discovery
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.003 Command and Scripting Interpreter: Windows Command Shell |
| Stealth | T1036 Masquerading |
| Collection | T1074.001 Data Staged: Local Data Staging |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '6144.6643'
title: Output to File
description: 'Adversaries may stage collected data in a central location or directory
on the local system prior to Exfiltration. This use case looks for indicators of
commands being saved to a file such as ">" or ">>". Typically a new process
is not created when executed from a command prompt, however adversaries may output
process results to a txt document during discovery. -- Threat Actor Association:
Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
OilRig, TeamTNT - Software Association: Bazar, Clop, Conti, DarkWatchman, EagleEye,
Hive, Koxic, Polyglot, SysJoker Atomics T1059.003 Test #2 Atomics T1059.003 Test
#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) (TERM(>) OR ">>" OR ">") | regex process="(?i)(\s+|\;|\:\,|\d+|\|)?(\>{1,2})(\s|\;|\:\,\|).{1,}|\s+>"
| table _time, host, user user, process | bin span=1s | stats values(*) as * by
_time, host '
techniques:
- collection:data staged:local data staging
- defense-evasion:masquerading
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1074.001
- T1036
- T1059.003
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (TERM(>) OR ">>" OR ">")
Stage 2: regex
| regex process="(?i)(\s+|\;|\:\,|\d+|\|)?(\>{1,2})(\s|\;|\:\,\|).{1,}|\s+>"
Stage 3: table
| table _time, host, user user, process
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | ">" |
| 1 | ">>" |
| 1 | ">" |