Browse Rules

Local Network Sniffing

Adversaries may use a variety of tools to gain visibility on the current status of things on the network: which processes are listening on which ports, which services are running on other hosts, etc. This analytic looks for the names of the most common network sniffing tools. While this may be noisy on networks where sysadmins are using any of these tools on a regular basis, in most networks their use is noteworthy.

Unusual Linux Network Activity

Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.

Unexpected Network Connection from System Process [splunk-winevent]

Threat actors may abuse legitimate system processes that typically lack network functionality to perform malicious network activity, helping evade detection and blend in with normal system behavior. This technique is often associated with process injection or masquerading, where code is executed within trusted processes to establish command-and-control (C2) channels or exfiltrate data. This use case detects instances where non-networking system processes (e.g., conhost.exe, lsass.exe, wininit.ex

Unusual Windows Network Activity

Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.

Process Connection to Mega - Windows [splunk-sysmon]

Mega is a cloud storage service used by many threat actors due to its use of end-to-end encryption and semi-anonymous payment options. The client application MEGAsync.exe and command-line interface utility MegaCMD allow threat actors to exfiltrate large amounts of data. This use case detects network connections involving MEGASync.exe or MegaCMD or network connections to mega.co.nz or mega.nz (Sysmon only).

Process Connection to Mega - Windows [splunk-winevent]

Mega is a cloud storage service used by many threat actors due to its use of end-to-end encryption and semi-anonymous payment options. The client application MEGAsync.exe and command-line interface utility MegaCMD allow threat actors to exfiltrate large amounts of data. This use case detects network connections involving MEGASync.exe or MegaCMD or network connections to mega.co.nz or mega.nz (Sysmon only).

Network Share Connection Removal

Adversaries may use network shares to exfliltrate date; they will then remove the shares to cover their tracks. This analytic looks for the removal of network shares via commandline, which is otherwise a rare event.

Suspicious Non-Browser Network Communication With Telegram API

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

Process Discovery

Detects process discovery commands. Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

Suspicious Non-Browser Network Communication With Telegram API

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

QEMU Network Tunneling - Windows [splunk-winevent]

QEMU is an open-source machine emulator that allows for running multiple operating systems as separate processes. The use of QEMU executions with specific networking commands may indicate attempts at network tunneling or bypassing security controls, which was observed in intrusion reported on SecureList. This use case detects QEMU executions with command-line arguments that could be used to tunnel traffic.

List Open Egress Ports [splunk-sysmon]

Each port allowed outbound from a network creates an additional exit point for attackers to utilize. This use case looks for outbound port scans of the top 128 ports in use on the Internet as defined by the Nmap project. -- Software Association: IcedID, Nokoyawa -- Atomics T1016 Test #5

Potentially Suspicious Wuauclt Network Connection

Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections. One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.

Network Discovery Using Route Windows App

The following analytic detects the execution of the `route.exe` Windows application, commonly used for network discovery. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. This activity is significant because adversaries often use `route.exe` to map network routes and identify potential targets within a network. If confirmed malicious, this behavior could allow attackers to gain insights into network topology, facilitating lateral movement

Linux Network Sniffing [snowflake-crowdstrikefdr_process]

An attacker may use a variety of tools to sniff the traffic on the network of a compromised machine. This is part of reconnaissance after compromising a system in order to gather more information about the network or other potentially vulnerable services/servers in order to pivot to them or make lateral movements inside the network. Atomic Test T1040 - Test #1

Network Connection with Suspicious Folder [splunk-sysmon]

Detects potential downloads to suspicious file locations like temp, appdata, and downloads. - Threat Actor Association: Alloy Taurus/Gallium, Lazarus, NewsPenguin, OilRig, TA413 - Software Association: LOWZERO, Vidar Stealer

MsiExec Service Child Process With Network Connection

Identifies the execution of an MsiExec service child process followed by network or dns lookup activity. Adversaries may abuse Windows Installers for initial access and delivery of malware.

Potentially Suspicious Wuauclt Network Connection

Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections. One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.

Potentially Suspicious Network Connection To Notion API

Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"

Discovery of GitHub Actions Runner Process PID

This rule detects the discovery of the GitHub Actions Runner process PID using the pgrep command. Adversaries may use this technique to identify the PID of the GitHub Actions Runner process, which can be used to execute commands on the runner host. This behavior may indicate malicious or unexpected workflow activity, including code execution, file manipulation, or network exfiltration initiated through a compromised repository or unauthorized workflow.

Egress Network Connection from Default DPKG Directory

This rule monitors for network connections from processes that are executed from the /var/lib/dpkg/info/ directory. This directory is used to store information about installed packages. Attackers can backdoor the installation scripts of packages to establish network connections during the installation process to maintain persistence or to establish command and control.

Potentially Suspicious Network Connection To Notion API

Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"

Suspicious Network Connection Attempt by Root

Identifies an outbound network connection attempt followed by a session id change as the root user by the same process entity. This particular instantiation of a network connection is abnormal and should be investigated as it may indicate a potential reverse shell activity via a privileged process.

QEMU Network Tunneling - Windows [splunk-edr]

QEMU is an open-source machine emulator that allows for running multiple operating systems as separate processes. The use of QEMU executions with specific networking commands may indicate attempts at network tunneling or bypassing security controls, which was observed in intrusion reported on SecureList. This use case detects QEMU executions with command-line arguments that could be used to tunnel traffic.

QEMU Network Tunneling - Windows [splunk-powershell]

QEMU is an open-source machine emulator that allows for running multiple operating systems as separate processes. The use of QEMU executions with specific networking commands may indicate attempts at network tunneling or bypassing security controls, which was observed in intrusion reported on SecureList. This use case detects QEMU executions with command-line arguments that could be used to tunnel traffic.