Anvilogic critical experimental spl

WinSCP Execution [splunk-winevent]

WinSCP is an open source free SFTP client, FTP client, WebDAV client, S3 client and SCP client for Windows. Its main function is file transfer between a local and a remote computer. Adversaries have been known to use winscp in order to exfiltrate data. - Threat Actor Association: BlueNoroff, Lazarus, Stonefly, Wizard Spider -- Software Association: Akira, Bazar, Conti, LockBit, Play, Rhysida

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) 
OR "<EventID>4688<" 
OR Type=Process) ("winscp.exe" 
OR ("/command" 
OR "/script"))
| table _time, host, user process, process_*, signature_id, parent_*
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...