PuTTY Secure Copy Client Execution (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

pscp.exe is a tool in the PuTTY suite used for secure copy and has been used by threat actors including BlackCat and Agrius to exfiltrate data. This use case detects executions of pscp.exe.

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1048` Exfiltration Over Alternative Protocol

References

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.
Security-Auditing	Event ID 5156: The Windows Filtering Platform has permitted a connection.

Rule body

id: '24501.45205'
title: PuTTY Secure Copy Client Execution
description: pscp.exe is a tool in the PuTTY suite used for secure copy and has been
  used by threat actors including BlackCat and Agrius to exfiltrate data. This use
  case detects executions of pscp.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) OR (TERM(EventCode=5156) OR "<EventID>5156<"))
  "pscp.exe" | table _time, host, user process, process_*, signature_id, parent_*
  | bin span=60s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over alternative protocol
technique_id: 
- T1048
data_category:
- Windows event logs
references:
- https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
- https://www.trendmicro.com/en_us/research/23/f/malvertising-used-as-entry-vector-for-blackcat-actors-also-lever.html

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) OR (TERM(EventCode=5156) OR "<EventID>5156<")) "pscp.exe"

Stage 2: `table`

| table _time, host, user process, process_*, signature_id, parent_*

Stage 3: `bucket`

| bin span=60s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1) `5156` corpus 15 (splunk 13, kusto 2)	`field:"EventID" kind:eq`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4688<"`
1	`"<EventID>5156<"`
1	`"pscp.exe"`