Detection rules › Splunk
QEMU Network Tunneling - Windows (Sysmon)
QEMU is an open-source machine emulator that allows for running multiple operating systems as separate processes. The use of QEMU executions with specific networking commands may indicate attempts at network tunneling or bypassing security controls, which was observed in intrusion reported on SecureList. This use case detects QEMU executions with command-line arguments that could be used to tunnel traffic.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1095 Non-Application Layer Protocol, T1572 Protocol Tunneling |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '29624.53381'
title: QEMU Network Tunneling - Windows
description: 'QEMU is an open-source machine emulator that allows for running multiple
operating systems as separate processes. The use of QEMU executions with specific
networking commands may indicate attempts at network tunneling or bypassing security
controls, which was observed in intrusion reported on SecureList. This use case
detects QEMU executions with command-line arguments that could be used to tunnel
traffic. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"qemu-system-" ("-net " OR "-netdev" OR "-redir" OR "socket" OR "listen" OR "-device"
OR "hostfwd=") | table _time, host, user, process, process_*, parent_process_name,
parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:protocol tunneling
- command-and-control:non-application layer protocol
technique_id:
- T1572
- T1095
data_category:
- Windows Sysmon
references:
- https://securelist.com/network-tunneling-with-qemu/111803/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "qemu-system-" ("-net " OR "-netdev" OR "-redir" OR "socket" OR "listen" OR "-device" OR "hostfwd=")
Stage 2: table
| table _time, host, user, process, process_*, parent_process_name, parent_process_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "qemu-system-" |
| 1 | "-net " |
| 1 | "-netdev" |
| 1 | "-redir" |
| 1 | "socket" |
| 1 | "listen" |
| 1 | "-device" |
| 1 | "hostfwd=" |