Detection rules › Splunk
Script Connected to External Destination - Windows (Sysmon)
Adversaries may use scripts to connect to external locations for C2 communications, downloading and executing payloads, data exfiltration, or redirection. This use case detects when a Windows script interpreter (wscript, cscript, mshta, rundll32) connects to external IPv4 or IPv6 destinations.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059 Command and Scripting Interpreter |
| Exfiltration | T1041 Exfiltration Over C2 Channel |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 3 | Network connection |
Rule body yaml
id: '21196.37652'
title: Script Connected to External Destination - Windows
description: Adversaries may use scripts to connect to external locations for C2 communications,
downloading and executing payloads, data exfiltration, or redirection. This use
case detects when a Windows script interpreter (wscript, cscript, mshta, rundll32)
connects to external IPv4 or IPv6 destinations.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=3) OR "<EventID>3<")
TERM(wscript) OR TERM(cscript) OR TERM(mshta) OR TERM(rundll32) | regex dest_ip!="(?i)^(127|10|172\.1[6-9]|172\.2[0-9]|172\.3[0-1]|192\.168|169\.254|20)\.|(::1|0:0:0:0:0:0:0:1|fe80:|fc|fd)"
| table _time, host, user parent_*, process, process_*, dest_ip, dest_host | bin
span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
- exfiltration:exfiltration over c2 channel
technique_id:
- T1059
- T1041
data_category:
- Windows Sysmon
references:
- https://www.virustotal.com/gui/file/d439a3ce7353ef96cf3556abba1e5da77eac21fdba09d6a4aad42d1fc88c1e3c/behavior
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=3) OR "<EventID>3<") TERM(wscript) OR TERM(cscript) OR TERM(mshta) OR TERM(rundll32)
Stage 2: regex
| regex dest_ip!="(?i)^(127|10|172\.1[6-9]|172\.2[0-9]|172\.3[0-1]|192\.168|169\.254|20)\.|(::1|0:0:0:0:0:0:0:1|fe80:|fc|fd)"
Stage 3: table
| table _time, host, user parent_*, process, process_*, dest_ip, dest_host
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
dest_ip | regex_match | "(?i)^(127|10|172.1[6-9]|172.2[0-9]|172.3[0-1]|192.168|169.254|20)., (::1|0:0:0:0:0:0:0:1|fe80:|fc|fd)" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>3<" |
| 1 | TERM |
| 1 | wscript |
| 1 | TERM |
| 1 | cscript |
| 1 | TERM |
| 1 | mshta |
| 1 | TERM |
| 1 | rundll32 |