Detection rules › Splunk
PuTTY Secure Copy Client Execution (Windows Event Log)
pscp.exe is a tool in the PuTTY suite used for secure copy and has been used by threat actors including BlackCat and Agrius to exfiltrate data. This use case detects executions of pscp.exe.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration | T1048 Exfiltration Over Alternative Protocol |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 5156 | The Windows Filtering Platform has permitted a connection. |
Rule body yaml
id: '24501.45205'
title: PuTTY Secure Copy Client Execution
description: pscp.exe is a tool in the PuTTY suite used for secure copy and has been
used by threat actors including BlackCat and Agrius to exfiltrate data. This use
case detects executions of pscp.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) OR (TERM(EventCode=5156) OR "<EventID>5156<"))
"pscp.exe" | table _time, host, user process, process_*, signature_id, parent_*
| bin span=60s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over alternative protocol
technique_id:
- T1048
data_category:
- Windows event logs
references:
- https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
- https://www.trendmicro.com/en_us/research/23/f/malvertising-used-as-entry-vector-for-blackcat-actors-also-lever.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) OR (TERM(EventCode=5156) OR "<EventID>5156<")) "pscp.exe"
Stage 2: table
| table _time, host, user process, process_*, signature_id, parent_*
Stage 3: bucket
| bin span=60s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | "<EventID>5156<" |
| 1 | "pscp.exe" |