Remote Admin Tools (Sysmon)

Group by: _time, command_line, host
Source: github.com/anvilogic-forge/armory

PsExec, RemCom, PaExec, and CsExec are administrative command-line utilities that allow remote command execution

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.003` Command and Scripting Interpreter: Windows Command Shell `T1569.002` System Services: Service Execution
Lateral Movement	`T1021` Remote Services `T1570` Lateral Tool Transfer

References

https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '5343.5722'
title: 'Remote Admin Tools  '
description: 'PsExec, RemCom, PaExec, and CsExec are administrative command-line utilities
  that allow remote command execution Threat Actor Association: Antlion, DarkSide,
  BlackMatter, APT29/Nobelium, APT31, Carbanak, FIN6, FIN7, FIN8, FIN12, Fox Kitten,
  GoldenJackal, Hello Kitty / Five Hands, MalKamak, Muddled Libra, OilRig, Traveling
  Spider, UNC2596, Vice Society, Wizard Spider - Software Association: ALPHV/BlackCat,
  AvosLocker, BianLian, Blackbyte, Blacksuit, Black Basta, Conti, Cuba, GhostShell,
  Lockbit, Play, Prometheus/Spook, Prestige, PYSA/Mespinoza, Quantum, Rhysida, Royal,
  Vice Society - Atomics T1021.002 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 ".exe" "\\\\"|
  regex process="(\.exe(\")?\s+|\/c.{1,}?)\x5c\x5c.{2,}" | table _time, host, user
  process, process_*, parent_process, parent_process_*, src_user | bin span=1s | stats
  values(*) as * by _time, host, process `hec_collect`'
techniques:
- execution:system services:service execution
- lateral-movement:remote services
- execution:command and scripting interpreter:windows command shell
- lateral-movement:lateral tool transfer
technique_id:
- T1569.002
- T1021
- T1059.003
- T1570
data_category:
- Windows Sysmon
references:
- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 ".exe" "\\\\"

Stage 2: `regex`

| regex process="(\.exe(\")?\s+|\/c.{1,}?)\x5c\x5c.{2,}"

Stage 3: `table`

| table _time, host, user process, process_*, parent_process, parent_process_*, src_user

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host, process `hec_collect`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process`	regex_match	`"(.exe(\")?\s+\|\/c.{1,}?)\x5c\x5c.{2,}"`	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`".exe"`
1	`"\\\\"`