Script Connected to External Destination - Windows (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may use scripts to connect to external locations for C2 communications, downloading and executing payloads, data exfiltration, or redirection. This use case detects when a Windows script interpreter (wscript, cscript, mshta, rundll32) connects to external IPv4 or IPv6 destinations.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter
Exfiltration	`T1041` Exfiltration Over C2 Channel

References

https://www.virustotal.com/gui/file/d439a3ce7353ef96cf3556abba1e5da77eac21fdba09d6a4aad42d1fc88c1e3c/behavior

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5156: The Windows Filtering Platform has permitted a connection.

Rule body

id: '21196.37653'
title: Script Connected to External Destination - Windows
description: Adversaries may use scripts to connect to external locations for C2 communications,
  downloading and executing payloads, data exfiltration, or redirection. This use
  case detects when a Windows script interpreter (wscript, cscript, mshta, rundll32)
  connects to external IPv4 or IPv6 destinations.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR
  "<EventID>5156<") TERM(wscript) OR TERM(cscript) OR TERM(mshta) OR TERM(rundll32)
  | regex dest_ip!="(?i)^(127|10|172\.1[6-9]|172\.2[0-9]|172\.3[0-1]|192\.168|169\.254|20)\.|(::1|0:0:0:0:0:0:0:1|fe80:|fc|fd)"
  | table _time, host, user parent_*, process, process_*, dest_ip, dest_host | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
- exfiltration:exfiltration over c2 channel
technique_id: 
- T1059
- T1041
data_category:
- Windows event logs
references:
- https://www.virustotal.com/gui/file/d439a3ce7353ef96cf3556abba1e5da77eac21fdba09d6a4aad42d1fc88c1e3c/behavior

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR "<EventID>5156<") TERM(wscript) OR TERM(cscript) OR TERM(mshta) OR TERM(rundll32)

Stage 2: `regex`

| regex dest_ip!="(?i)^(127|10|172\.1[6-9]|172\.2[0-9]|172\.3[0-1]|192\.168|169\.254|20)\.|(::1|0:0:0:0:0:0:0:1|fe80:|fc|fd)"

Stage 3: `table`

| table _time, host, user parent_*, process, process_*, dest_ip, dest_host

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`dest_ip`	regex_match	`"(?i)^(127\|10\|172.1[6-9]\|172.2[0-9]\|172.3[0-1]\|192.168\|169.254\|20).`, `(::1\|0:0:0:0:0:0:0:1\|fe80:\|fc\|fd)"`	`excludes:dest_ip`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`5156` corpus 15 (splunk 13, kusto 2)	`field:"EventID" kind:eq value:"5156"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>5156<"`
1	`wscript`
1	`cscript`
1	`mshta`
1	`rundll32`