admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inWindows Curl Upload to Remote Destination

Browse Source
This commit is contained in:
root
2021-11-10 16:59:52 +00:00
parent 2e6033cc8b
commit b2225bf9de
1 changed files with 34 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_curl_upload_to_remote_destination.yml
+34 -22
View File
@@ -9,32 +9,43 @@ datamodel:
description: 'The following analytic identifies the use of Windows Curl.exe uploading
a file to a remote destination. \
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
\
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
web application, and it is, for example, how most common HTML forms on the web work.
\
HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
HTTP multipart formposts are done with `-F`, but this appears to not be compatible
with the Windows version of Curl. Will update if identified adversary tradecraft.
\
Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt).
During triage, review parallel processes for further behavior. In addition, identify
if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.'
Adversaries may use one of the three methods based on the remote destination and
what they are attempting to upload (zip vs txt). During triage, review parallel
processes for further behavior. In addition, identify if the upload was successful
in network logs. If a file was uploaded, isolate the endpoint and review.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *")
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_curl_upload_to_remote_destination_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives may be limited to source control applications and may be required to be filtered out.
IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest
Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives may be limited to source control applications
and may be required to be filtered out.
references:
- https://everything.curl.dev/usingcurl/uploads
- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
- https://twitter.com/d1r4c/status/1279042657508081664?s=20
- https://everything.curl.dev/usingcurl/uploads
- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
- https://twitter.com/d1r4c/status/1279042657508081664?s=20
tags:
analytic_story:
- Ingress Tool Transfer
dataset: []
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
kill_chain_phases:
- Exfiltration
mitre_attack_id:
@@ -47,11 +58,11 @@ tags:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
@@ -81,4 +92,5 @@ tags:
- name: process_name
type: Process
role:
- Child Process
- Child Process
automated_detection_testing: passed