Detection rules › Splunk
Tunneling Process Created (Sysmon)
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Common tools include Iodine, DNSCat, and Plink
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1095 Non-Application Layer Protocol, T1572 Protocol Tunneling |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '1139.1235'
title: Tunneling Process Created
description: 'Adversaries may tunnel network communications to and from a victim system
within a separate protocol to avoid detection/network filtering and/or enable access
to otherwise unreachable systems. Common tools include Iodine, DNSCat, and Plink
-- Threat Actor Association: Agrius, Alloy Taurus/Gallium, APT34, FIN6, Lazarus,
Magic Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), Magnat,
Memento Team, OilRig, TRACER KITTEN -- Software Association: BadHatch, Lockbit,
LV, Royal, Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 | regex process="(?i)(\-\-dns)?((\s+)|(\=))?((server\=)|(host\=))?((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\,port\=\d{1,5}.+)|(\w+\.((com)|(org)|(net)|(info)))$)|(\w+\.((com)|(org)|(net)|(info))\:\d{1,5})|(\w+\@(\d{1,3}\.){3}\d{1,3}.+\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5})|(\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5}.+\w+\@(\d{1,3}\.){3}\d{1,3})|(\d{1,5}\s+?(\d{1,3}\.){3}\d{1,3}\:\d{1,5})"
| table _time, host, user, signature_id, process_*, parent_process, parent_process_*,
user | bin span=1s | stats values(*) as * by _time, host, process '
techniques:
- command-and-control:protocol tunneling
- command-and-control:non-application layer protocol
technique_id:
- T1572
- T1095
data_category:
- Windows Sysmon
references:
- https://github.com/yarrick/iodine
- https://github.com/iagox86/dnscat2
- https://github.com/kdsnice/Invoke-Plink
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1
Stage 2: regex
| regex process="(?i)(\-\-dns)?((\s+)|(\=))?((server\=)|(host\=))?((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\,port\=\d{1,5}.+)|(\w+\.((com)|(org)|(net)|(info)))$)|(\w+\.((com)|(org)|(net)|(info))\:\d{1,5})|(\w+\@(\d{1,3}\.){3}\d{1,3}.+\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5})|(\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5}.+\w+\@(\d{1,3}\.){3}\d{1,3})|(\d{1,5}\s+?(\d{1,3}\.){3}\d{1,3}\:\d{1,5})"
Stage 3: table
| table _time, host, user, signature_id, process_*, parent_process, parent_process_*, user
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host, process
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
process | regex_match |
|