Quick execution of a series of suspicious commands
Hypothesis and description
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
Commands of interest:
- arp.exe
- at.exe
- attrib.exe
- cscript.exe
- dsquery.exe
- hostname.exe
- ipconfig.exe
- mimikatz.exe
- nbstat.exe
- net.exe
- netsh.exe
- nslookup.exe
- ping.exe
- quser.exe
- qwinsta.exe
- reg.exe
- runas.exe
- sc.exe
- schtasks.exe
- ssh.exe
- systeminfo.exe
- taskkill.exe
- telnet.exe
- tracert.exe
- wscript.exe
- xcopy.exe
### Output Description
The host on which the commands were executed, the time of execution, and what commands were executed
- Platforms
- Windows, Linux, macOS
- Domain
- Analytic, Host
- Subtypes
- Process
- Submitted
- 2013-04-11
- Contributors
- MITRE
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1087 Account DiscoveryT1087.001, T1087.002 | Discovery | Low |
| T1003 OS Credential DumpingT1003.002 | Credential Access | Low |
| T1069 Permission Groups DiscoveryT1069.001, T1069.002 | Discovery | Low |
| T1057 Process Discovery | Discovery | Low |
| T1021 Remote ServicesT1021.002 | Lateral Movement | Low |
| T1543 Create or Modify System ProcessT1543.003 | Persistence, Privilege Escalation | Low |
| T1112 Modify Registry | Stealth (formerly Defense Evasion) | Low |
| T1574 Hijack Execution FlowT1574.011 | Persistence, Privilege Escalation | Low |
| T1018 Remote System Discovery | Discovery | Low |
| T1569 System ServicesT1569.002 | Execution | Low |
| T1053 Scheduled Task/JobT1053.002, T1053.005 | Persistence, Privilege Escalation, Execution | Low |
| T1029 Scheduled Transfer | Exfiltration | Low |
| T1033 System Owner/User Discovery | Discovery | Low |
| T1007 System Service Discovery | Discovery | Low |
| T1082 System Information Discovery | Discovery | Low |
| T1049 System Network Connections Discovery | Discovery | Low |
| T1016 System Network Configuration Discovery | Discovery | Low |
| T1010 Application Window Discovery | Discovery | Low |
| T1518 Software DiscoveryT1518.001 | Discovery | Low |
| T1046 Network Service Discovery | Discovery | Low |
| T1562 Impair DefensesT1562.001, T1562.006 | Stealth (formerly Defense Evasion) | Low |
| T1098 Account Manipulation | Credential Access | Low |
| T1059 Command and Scripting InterpreterT1059.005 | Execution | Moderate |
| T1012 Query Registry | Discovery | Low |
24 techniques, 39 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1003OS Credential Dumping
- T1007System Service Discovery
- T1010Application Window Discovery
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1021Remote Services
- T1029Scheduled Transfer
- T1033System Owner/User Discovery
- T1046Network Service Discovery
- T1049System Network Connections Discovery
- T1053Scheduled Task/Job
- T1057Process Discovery
- T1059Command and Scripting Interpreter
- T1069Permission Groups Discovery
- T1082System Information Discovery
- T1087Account Discovery
- T1098Account Manipulation
- T1112Modify Registry
- T1518Software Discovery
- T1543Create or Modify System Process
- T1562Impair Defenses
- T1569System Services
- T1574Hijack Execution Flow
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_groupedSigma version of the above pseudocode, with some modifications.
MITRE published no code for this implementation.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 includeLogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1Across MITRE's defensive frameworks
Linked through the 24 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SCFSystem Call Filtering13 shared
- D3-SCASystem Call Analysis11 shared
- D3-EALExecutable Allowlisting11 shared
- D3-EDLExecutable Denylisting11 shared
- D3-HBPIHardware-based Process Isolation10 shared
- D3-PSAProcess Spawn Analysis10 shared
- D3-CQContent Quarantine10 shared
- D3-CFContent Filtering9 shared
- D3-CMContent Modification9 shared
- D3-DFDecoy File9 shared
- D3-FAFile Analysis9 shared
- D3-FEFile Encryption9 shared