Output to File (Windows Event Log)

id: '6144.6643'
title: Output to File
description: 'Adversaries may stage collected data in a central location or directory
  on the local system prior to Exfiltration. This use case looks for indicators of
  commands being saved to a file such as ">" or ">>". Typically a new process
  is not created when executed from a command prompt, however adversaries may output
  process results to a txt document during discovery. -- Threat Actor Association:
  Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
  OilRig, TeamTNT - Software Association: Bazar, Clop, Conti, DarkWatchman, EagleEye,
  Hive, Koxic, Polyglot, SysJoker Atomics T1059.003 Test #2 Atomics T1059.003 Test
  #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(>) OR ">>" OR ">") | regex process="(?i)(\s+|\;|\:\,|\d+|\|)?(\>{1,2})(\s|\;|\:\,\|).{1,}|\s+>"
  | table _time, host, user user, process | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- collection:data staged:local data staging
- defense-evasion:masquerading
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1074.001
- T1036
- T1059.003
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/