Detection: LOLBAS Rare Network Connection

Description

The following analytic identifies public network connections initiated by Living Off the Land Binaries and Scripts (LOLBAS) that rarely require direct outbound network access. It leverages the Network Traffic data model and focuses on native Windows binaries where any public destination should be investigated and explicitly approved. This activity may indicate proxy execution, process injection, payload download, command-and-control, or other abuse of trusted binaries to evade security controls. Keep in mind that some of these binaries, such as Netsh.exe, Gpscript.exe, Wmic.exe, etc., will occasionally communicate with public network resources to perform their intended function. Exclude said processes from the detection if they are too noisy for your environment. Join this detection with the Process Execution events to provide context and avoid false positives.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6from datamodel=Network_Traffic.All_Traffic where
 7
 8All_Traffic.app IN (
 9    "*\\at.exe",
10    "*\\atbroker.exe",
11    "*\\certoc.exe",
12    "*\\diskshadow.exe",
13    "*\\dnscmd.exe",
14    "*\\extexport.exe",
15    "*\\forfiles.exe",
16    "*\\gpscript.exe",
17    "*\\infdefaultinstall.exe",
18    "*\\installutil.exe",
19    "*\\makecab.exe",
20    "*\\mavinject.exe",
21    "*\\microsoft.workflow.compiler.exe",
22    "*\\msconfig.exe",
23    "*\\netsh.exe",
24    "*\\notepad.exe",
25    "*\\odbcconf.exe",
26    "*\\offlinescannershell.exe",
27    "*\\pcalua.exe",
28    "*\\pcwrun.exe",
29    "*\\pnputil.exe",
30    "*\\rasautou.exe",
31    "*\\regasm.exe",
32    "*\\register-cimprovider.exe",
33    "*\\regsvcs.exe",
34    "*\\regsvr32.exe",
35    "*\\runonce.exe",
36    "*\\runscripthelper.exe",
37    "*\\schtasks.exe",
38    "*\\scriptrunner.exe",
39    "*\\stordiag.exe",
40    "*\\ttdinject.exe",
41    "*\\tttracer.exe",
42    "*\\verclsid.exe",
43    "*\\wab.exe",
44    "*\\wmic.exe",
45    "*\\xwizard.exe"
46    )
47
48NOT All_Traffic.dest_ip IN (
49        "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
50        "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
51        "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
52        "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
53        "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
54        "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
55        "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24",
56        "203.0.113.0/24", "240.0.0.0/4"
57    )
58
59by All_Traffic.action All_Traffic.app All_Traffic.dest
60   All_Traffic.dest_ip All_Traffic.dest_port
61   All_Traffic.direction All_Traffic.dvc All_Traffic.protocol
62   All_Traffic.protocol_version All_Traffic.src
63   All_Traffic.src_ip All_Traffic.src_port
64   All_Traffic.transport All_Traffic.user
65   All_Traffic.vendor_product
66
67
68| `drop_dm_object_name(All_Traffic)`
69
70| `security_content_ctime(firstTime)`
71
72| `security_content_ctime(lastTime)`
73
74| `lolbas_rare_network_connection_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 3	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model.

Known False Positives

Limited legitimate administrative automation and scripts may cause false positives. Any recurring use of these binaries for public network access should be reviewed, approved, and filtered with the analytic filter macro. Notepad.exe can now communicate with Microsoft's service "apsaiservices.microsoft.com" over port 443 to provide AI services. Apply filtering if this behavior is known in your environment. PowerShell, PowerShell ISE, PowerShell 7 (pwsh.exe), and cmd.exe are intentionally excluded from this analytic because they are too noisy.

Associated Analytic Story

• Living Off The Land

• APT37 Rustonotto and FadeStealer

• Fake CAPTCHA Campaigns

• Water Gamayun

• Hellcat Ransomware

• NetSupport RMM Tool Abuse

• Malicious Inno Setup Loader

• GhostRedirector IIS Module and Rungan Backdoor

Intermediate Findings

Threat Objects

References

• https://lolbas-project.github.io/#

• https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1