Detection rules › Splunk
Tunneling Process Created (PowerShell)
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Common tools include Iodine, DNSCat, and Plink
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1095 Non-Application Layer Protocol, T1572 Protocol Tunneling |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
id: '1139.1216'
title: Tunneling Process Created
description: 'Adversaries may tunnel network communications to and from a victim system
within a separate protocol to avoid detection/network filtering and/or enable access
to otherwise unreachable systems. Common tools include Iodine, DNSCat, and Plink
-- Threat Actor Association: Agrius, Alloy Taurus/Gallium, APT34, FIN6, Lazarus,
Magic Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), Magnat,
Memento Team, OilRig, TRACER KITTEN -- Software Association: BadHatch, Lockbit,
LV, Royal, Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` EventCode=4104 (TERM(--dns)
OR TERM(server) OR TERM(host) OR TERM(com) OR TERM(org) OR TERM(net) OR TERM(info)
OR TERM(listen) OR TERM(host) OR ("@" AND (TERM(-D) OR TERM(-R) OR TERM(-L)))) |
rex field=process mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock ID.+)|^(Creating
Scriptblock.+)//g"| rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g"| regex process="(?i)(\-\-dns)?((\s+)|(\=))?((server\=)|(host\=))?((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\,port\=\d{1,5}.+)|(\w+\.((com)|(org)|(net)|(info)))$)|(\w+\.((com)|(org)|(net)|(info))\:\d{1,5})|(\w+\@(\d{1,3}\.){3}\d{1,3}.+\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5})|(\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5}.+\w+\@(\d{1,3}\.){3}\d{1,3})|(\d{1,5}\s+?(\d{1,3}\.){3}\d{1,3}\:\d{1,5})"
| table _time, host, user, signature_id, process_name, process, user | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- command-and-control:protocol tunneling
- command-and-control:non-application layer protocol
technique_id:
- T1572
- T1095
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/yarrick/iodine
- https://github.com/iagox86/dnscat2
- https://github.com/kdsnice/Invoke-Plink
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` EventCode=4104 (TERM(--dns) OR TERM(server) OR TERM(host) OR TERM(com) OR TERM(org) OR TERM(net) OR TERM(info) OR TERM(listen) OR TERM(host) OR ("@" AND (TERM(-D) OR TERM(-R) OR TERM(-L))))
Stage 2: eval
| rex field=process mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock ID.+)|^(Creating Scriptblock.+)//g"
Stage 3: eval
| rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g"
Stage 4: regex
| regex process="(?i)(\-\-dns)?((\s+)|(\=))?((server\=)|(host\=))?((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\,port\=\d{1,5}.+)|(\w+\.((com)|(org)|(net)|(info)))$)|(\w+\.((com)|(org)|(net)|(info))\:\d{1,5})|(\w+\@(\d{1,3}\.){3}\d{1,3}.+\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5})|(\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5}.+\w+\@(\d{1,3}\.){3}\d{1,3})|(\d{1,5}\s+?(\d{1,3}\.){3}\d{1,3}\:\d{1,5})"
Stage 5: table
| table _time, host, user, signature_id, process_name, process, user
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
process | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "--dns" |
| 1 | TERM |
| 1 | server |
| 1 | TERM |
| 1 | TERM |
| 1 | com |
| 1 | TERM |
| 1 | org |
| 1 | TERM |
| 1 | net |
| 1 | TERM |
| 1 | info |
| 1 | TERM |
| 1 | listen |
| 1 | TERM |
| 1 | "@" |
| 1 | "-D" |
| 1 | "-R" |
| 1 | "-L" |