Suspicious Arguments

Hypothesis and description

Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better blend in with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters.

Any tool of interest with commonly known command line usage can be detecting by command line analysis. Known substrings of command lines include

- PuTTY

- port forwarding -R * -pw

- secure copy (scp) -pw * * *@*

- mimikatz sekurlsa::

- RAR * -hp *

- Archive* a *

Additionally, it may be useful to find IP addresses in the command line

- \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}

Logically this analytic makes use of CAR-2014-03-005.

Platforms: Windows, Linux, macOS
Domain: Host
Subtypes: Process
Submitted: 2013-07-05
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1003 OS Credential DumpingT1003.001	Credential Access	Low
T1021 Remote Services	Lateral Movement	Moderate
T1105 Ingress Tool Transfer	Command and Control, Lateral Movement	Moderate

3 techniques, 4 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

Identify process launches that contain substrings that belong to known tools and do not match the expected process names. These will help to indicate instances of tools that have been renamed.

process = search Process:Create
port_fwd = filter process where (command_line match "-R .* -pw")
scp = filter process where (command_line match "-pw .* .* .*@.*"
mimikatz = filter process where (command_line match "sekurlsa")
rar = filter process where (command_line match " -hp ")
archive = filter process where (command_line match ".* a .*")
ip_addr = filter process where (command_line match \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

output port_fwd, scp, mimikatz, rar, archive, ip_addr

SplunkData model: Sysmon native

Splunk version of the above pseudocode, excluding the IP address search.

index=__your_sysmon_index__ EventCode=1 (CommandLine="* -R * -pw*" OR CommandLine="* -pw * *@*" OR CommandLine="*sekurlsa*" OR CommandLine="* -hp *" OR CommandLine="* a *")

EQLData model: EQL native

EQL version of the above pseudocode, excluding the IP address search.

process where subtype.create and
  (command_line == "* -R * -pw*" or command_line == "* -pw * *@*" or command_line == "*sekurlsa*" or command_line == "* -hp *" or command_line == "* a *")

SplunkData model: Sysmon native

Splunk version of the above pseudocode, solely for the IP address search. Note that this will likely result in many false positives, since things like software version numbers can also be valid IPv4 addresses.

index=__your_sysmon_index__ EventCode=1 |regex CommandLine=".*\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}\b.*"

DNIFData model: Sysmon native

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*(\-r.*\-pw|\-pw.*\@|sekurlsa|\-hp| a |\\d\{1\,3\}\\\.\\d\{1\,3\}\\\.\\d\{1\,3\}).*)i limit 100

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 (command="* -R * -pw*" OR command="* -pw * *@*" OR command="*sekurlsa*" OR command="* -hp *" OR command="* a *")

Across MITRE's defensive frameworks

Linked through the 3 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

39 more in the full list

View CAR-2013-07-001 on car.mitre.org

Hypothesis and description

Any tool of interest with commonly known command line usage can be detecting by command line analysis. Known substrings of command lines include

- PuTTY

- port forwarding -R * -pw

- secure copy (scp) -pw * * *@*

- mimikatz sekurlsa::

- RAR * -hp *

- Archive* a *

Additionally, it may be useful to find IP addresses in the command line

- \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}

Logically this analytic makes use of CAR-2014-03-005.

ATT&CK coverage

Technique	Tactics	Coverage
T1003 OS Credential DumpingT1003.001	Credential Access	Low
T1021 Remote Services	Lateral Movement	Moderate
T1105 Ingress Tool Transfer	Command and Control, Lateral Movement	Moderate

Pseudocode and implementations

Pseudocode

Identify process launches that contain substrings that belong to known tools and do not match the expected process names. These will help to indicate instances of tools that have been renamed.

process = search Process:Create
port_fwd = filter process where (command_line match "-R .* -pw")
scp = filter process where (command_line match "-pw .* .* .*@.*"
mimikatz = filter process where (command_line match "sekurlsa")
rar = filter process where (command_line match " -hp ")
archive = filter process where (command_line match ".* a .*")
ip_addr = filter process where (command_line match \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

output port_fwd, scp, mimikatz, rar, archive, ip_addr

SplunkData model: Sysmon native

Splunk version of the above pseudocode, excluding the IP address search.

index=__your_sysmon_index__ EventCode=1 (CommandLine="* -R * -pw*" OR CommandLine="* -pw * *@*" OR CommandLine="*sekurlsa*" OR CommandLine="* -hp *" OR CommandLine="* a *")

EQLData model: EQL native

EQL version of the above pseudocode, excluding the IP address search.

process where subtype.create and
  (command_line == "* -R * -pw*" or command_line == "* -pw * *@*" or command_line == "*sekurlsa*" or command_line == "* -hp *" or command_line == "* a *")

SplunkData model: Sysmon native

index=__your_sysmon_index__ EventCode=1 |regex CommandLine=".*\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}\b.*"

DNIFData model: Sysmon native

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*(\-r.*\-pw|\-pw.*\@|sekurlsa|\-hp| a |\\d\{1\,3\}\\\.\\d\{1\,3\}\\\.\\d\{1\,3\}).*)i limit 100

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 (command="* -R * -pw*" OR command="* -pw * *@*" OR command="*sekurlsa*" OR command="* -hp *" OR command="* a *")