Powershell ICMP Data Exfiltration (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may steal data by exfiltrating it over an existing command and control channel. Use case attempts to detect powershell scripts with specific ICMP calls that may be attributed to data exfil

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell
Exfiltration	`T1041` Exfiltration Over C2 Channel

References

https://raw.githubusercontent.com/cyb3rw01f/icmpExfiltrater/master/icmpExfiltrater.ps1

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.

Rule body

id: '5538.5778'
title: Powershell ICMP Data Exfiltration
description: 'Adversaries may steal data by exfiltrating it over an existing command
  and control channel. Use case attempts to detect powershell scripts with specific
  ICMP calls that may be attributed to data exfil. - Software Association: Alchimist
  - Atomics T1048.003 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4103) TERM(System)
  TERM(Net) TERM(NetworkInformation) TERM(ping) | rex field=Message "(?i)script\s+?name\s+?\=\s+?(?<script>.{1,}?\.ps1)"
  | table _time, host, user signature_id, process, process_*, script | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- exfiltration:exfiltration over c2 channel
technique_id:
- T1059.001
- T1041
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://raw.githubusercontent.com/cyb3rw01f/icmpExfiltrater/master/icmpExfiltrater.ps1

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4103) TERM(System) TERM(Net) TERM(NetworkInformation) TERM(ping)

Stage 2: `rex`

| rex field=Message "(?i)script\s+?name\s+?\=\s+?(?<script>.{1,}?\.ps1)"

Stage 3: `table`

| table _time, host, user signature_id, process, process_*, script

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4103` corpus 105 (splunk 105)	`field:"EventID" kind:eq value:"4103"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`System`
1	`Net`
1	`NetworkInformation`
1	`ping`