Detection rules › Splunk
Suspicious File written to Disk (Windows Event Log)
Adversaries may transfer tools or other files from an external system into a compromised environment. As seen with Solorigate when backdoor activates, the executing process (usually SolarWinds.BusinessLayerHost.exe) creates two files on disk. This use case looks for when dlls or vbs files added to Disk
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4656: A handle to an object was requested. |
Rule body
id: '5856.6154'
title: Suspicious File written to Disk
description: 'Adversaries may transfer tools or other files from an external system
into a compromised environment. As seen with Solorigate when backdoor activates,
the executing process (usually SolarWinds.BusinessLayerHost.exe) creates two files
on disk. This use case looks for when dlls or vbs files added to Disk. -- Threat
Actor Association: APT29/Nobelium/Cozy Bear, APT31, APT34/OilRig, APT41, FIN7, Gamaredon
(aka. Armageddon, UAC-0010), Gorgon Group, Harvester, Lazarus, Night Spider, TA413,
TA551, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003), UNC2465, Wizard Spider
-- Software Association: ALPHV/BlackCat, Bazar, Black Basta, Clop, DirtyMoe, Dridex,
Hive, IcedID, LOWZERO, PowerShortShell, Quantum, Qakbot/Qbot, RATDispenser, Remcos,
Royal, Ryuk, SmokedHAM, Soul, VawTrak, Vidar Stealer, XingLocker'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
"<EventID>4656<") (TERM(dll) OR TERM(vbs)) NOT DELETE| regex Object_Name="(?i)\.(dll|vbs)"
| rename Object_Name as file_path | table _time, host, user, event_id, file_path,
process_name, process_path, signature_id | bin span=60s | stats values(*) as * by
_time, host | eventstats dc(file_path) as dc_file_path by process_name | where dc_file_path
< 3 and event_count < 4 '
techniques:
- command-and-control:ingress tool transfer
technique_id:
- T1105
data_category:
- File monitoring
- Windows event logs
references: null
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR "<EventID>4656<") (TERM(dll) OR TERM(vbs)) NOT DELETE
Stage 2: regex
| regex Object_Name="(?i)\.(dll|vbs)"
Stage 3: rename
| rename Object_Name as file_path
Stage 4: table
| table _time, host, user, event_id, file_path, process_name, process_path, signature_id
Stage 5: bucket
| bin span=60s
Stage 6: stats
| stats values(*) as * by _time, host
Stage 7: eventstats
| eventstats dc(file_path) as dc_file_path by process_name
Stage 8: where
| where dc_file_path < 3 and event_count < 4
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4656" |
Object_Name | regex_match |
| field:"Object_Name" kind:regex_match |
dc_file_path | lt |
| field:"dc_file_path" kind:lt value:"3" |
event_count | lt |
| field:"event_count" kind:lt value:"4" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4656<" |
| 1 | dll |
| 1 | vbs |