AnomalyCAR-2021-01-002

Unusually Long Command Line Strings

Hypothesis and description

Often, after a threat actor gains access to a system, they will attempt to run some kind of malware to further infect the victim machine. These malware often have long command line strings, which could be a possible indicator of attack. Here, we use sysmon and Splunk to first find the average command string length and search for command strings that stretch over multiple lines, thus identifying anomalies and possibly malicious commands.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-11-27
Contributors: Cyware Labs

ATT&CK coverage

Technique	Tactics	Coverage
T1059 Command and Scripting Interpreter	Execution	Low

1 technique. Links open MITRE ATT&CK.

T1059Command and Scripting Interpreter

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

process/create/command_line

Pseudocode and implementations

SplunkSplunk search - Identifying possible malware activity via unusually long command line stringsData model: Sysmon native

This is a Splunk query that determines the average length of a command per user and searches for a command string that is multiple times longer than the average length

index=* sourcetype="xmlwineventlog" EventCode=4688  |eval cmd_len=len(CommandLine) | eventstats avg(cmd_len) as avg by host| stats max(cmd_len) as maxlen, values(avg) as avgperhost by host, CommandLine | where maxlen > 10*avgperhost

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

3 more in the full list

View CAR-2021-01-002 on car.mitre.org

Hypothesis and description

Technique

Tactics

Coverage

T1059 Command and Scripting Interpreter

Execution

Low

Pseudocode and implementations

SplunkSplunk search - Identifying possible malware activity via unusually long command line stringsData model: Sysmon native

This is a Splunk query that determines the average length of a command per user and searches for a command string that is multiple times longer than the average length

index=* sourcetype="xmlwineventlog" EventCode=4688  |eval cmd_len=len(CommandLine) | eventstats avg(cmd_len) as avg by host| stats max(cmd_len) as maxlen, values(avg) as avgperhost by host, CommandLine | where maxlen > 10*avgperhost