Anvilogic high experimental spl
QEMU Network Tunneling - Windows [splunk-winevent]
QEMU is an open-source machine emulator that allows for running multiple operating systems as separate processes. The use of QEMU executions with specific networking commands may indicate attempts at network tunneling or bypassing security controls, which was observed in intrusion reported on SecureList. This use case detects QEMU executions with command-line arguments that could be used to tunnel traffic.
Detection Logic
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688)
OR "<EventID>4688<"
OR Type=Process) "qemu-system-" ("-net "
OR "-netdev"
OR "-redir"
OR "socket"
OR "listen"
OR "-device"
OR "hostfwd=")
| table _time, host, user, process, process_*, parent_process_name, parent_process_*
| bin span=1s
| stats values(*) as * by _time, hostField Validations
Loading…
Comments (0)
Loading comments...