Detection rules › Splunk
Suspicious File written to Disk (Windows Event Log)
Adversaries may transfer tools or other files from an external system into a compromised environment. As seen with Solorigate when backdoor activates, the executing process (usually SolarWinds.BusinessLayerHost.exe) creates two files on disk. This use case looks for when dlls or vbs files added to Disk
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1105 Ingress Tool Transfer |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4656 | A handle to an object was requested. |
Rule body yaml
id: '5856.6154'
title: Suspicious File written to Disk
description: 'Adversaries may transfer tools or other files from an external system
into a compromised environment. As seen with Solorigate when backdoor activates,
the executing process (usually SolarWinds.BusinessLayerHost.exe) creates two files
on disk. This use case looks for when dlls or vbs files added to Disk. -- Threat
Actor Association: APT29/Nobelium/Cozy Bear, APT31, APT34/OilRig, APT41, FIN7, Gamaredon
(aka. Armageddon, UAC-0010), Gorgon Group, Harvester, Lazarus, Night Spider, TA413,
TA551, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003), UNC2465, Wizard Spider
-- Software Association: ALPHV/BlackCat, Bazar, Black Basta, Clop, DirtyMoe, Dridex,
Hive, IcedID, LOWZERO, PowerShortShell, Quantum, Qakbot/Qbot, RATDispenser, Remcos,
Royal, Ryuk, SmokedHAM, Soul, VawTrak, Vidar Stealer, XingLocker'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
"<EventID>4656<") (TERM(dll) OR TERM(vbs)) NOT DELETE| regex Object_Name="(?i)\.(dll|vbs)"
| rename Object_Name as file_path | table _time, host, user, event_id, file_path,
process_name, process_path, signature_id | bin span=60s | stats values(*) as * by
_time, host | eventstats dc(file_path) as dc_file_path by process_name | where dc_file_path
< 3 and event_count < 4 '
techniques:
- command-and-control:ingress tool transfer
technique_id:
- T1105
data_category:
- File monitoring
- Windows event logs
references: null
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR "<EventID>4656<") (TERM(dll) OR TERM(vbs)) NOT DELETE
Stage 2: regex
| regex Object_Name="(?i)\.(dll|vbs)"
Stage 3: rename
| rename Object_Name as file_path
Stage 4: table
| table _time, host, user, event_id, file_path, process_name, process_path, signature_id
Stage 5: bucket
| bin span=60s
Stage 6: stats
| stats values(*) as * by _time, host
Stage 7: eventstats
| eventstats dc(file_path) as dc_file_path by process_name
Stage 8: where
| where dc_file_path < 3 and event_count < 4
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Object_Name | regex_match |
|
dc_file_path | lt |
|
event_count | lt |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4656<" |
| 1 | TERM |
| 1 | dll |
| 1 | TERM |
| 1 | vbs |
| 1 | DELETE |