Detection rules › Splunk
WebLogic CVE-2017-10271 (PowerShell)
A reverse shell is a shell session established on a connection that is initiated from a remote machine, not from the local host and in this case the session is created using the vulnerability of Weblogic app - wls-wsat Component Deserialization
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Execution |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4103: Payload Context: ContextInfo User Data: UserData. |
Rule body
id: '5454.5609'
title: WebLogic CVE-2017-10271
description: 'A reverse shell is a shell session established on a connection that
is initiated from a remote machine, not from the local host and in this case the
session is created using the vulnerability of Weblogic app - wls-wsat Component
Deserialization - Threat Actor Association: APT29/Nobelium/Cozy Bear -- #TrendingThreat
#Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(powershell) TERM(-w)
TERM(hidden) TERM(-nop) TERM(-c) TERM(function) TERM(RSC) AND "system.net.sockets.tcpclient"
AND "cmd.exe" AND "UseShellExecute" AND EventCode=4103 | rex field=process "\$a\=\''(?<src_ip>(?i)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
| rex field=process "\$p\=\''(?<dest_port>(?i)\d{1,5}") | table _time, host, user,
signature_id, process, src_ip, dest_port | bin span=1s | stats values(*) as * by
_time, host | lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns |
iplocation prefix="src_" src_ip| rename src_Country as src_country '
techniques:
- initial-access:exploit public-facing application
- execution:command and scripting interpreter:powershell
technique_id:
- T1190
- T1059.001
data_category:
- PowerShell logs
- Process command-line parameters
references: null
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` TERM(powershell) TERM(-w) TERM(hidden) TERM(-nop) TERM(-c) TERM(function) TERM(RSC) AND "system.net.sockets.tcpclient" AND "cmd.exe" AND "UseShellExecute" AND EventCode=4103
Stage 2: rex
| rex field=process "\$a\=\'(?<src_ip>(?i)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
Stage 3: rex
| rex field=process "\$p\=\'(?<dest_port>(?i)\d{1,5}")
Stage 4: table
| table _time, host, user, signature_id, process, src_ip, dest_port
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host
Stage 7: lookup
| lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns
Stage 8: search
| iplocation prefix="src_" src_ip
Stage 9: rename
| rename src_Country as src_country
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4103" |
prefix | eq |
| field:"prefix" kind:eq |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | powershell |
| 1 | "-w" |
| 1 | hidden |
| 1 | "-nop" |
| 1 | "-c" |
| 1 | function |
| 1 | RSC |
| 1 | "system.net.sockets.tcpclient" |
| 1 | "cmd.exe" |
| 1 | "UseShellExecute" |
| 8 | iplocation |
| 8 | src_ip |