Detection: Windows Process Outbound Connection To Social Media Domain

Description

This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. It leverages Sysmon Event ID 3 to surface this anomalous behavior. Legitimate Python applications rarely originate from paths such as "C:\Users\Public", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise. For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.

Search

 1`sysmon`
 2EventCode=3
 3Image IN (
 4    "*:\\$Recycle.Bin\\*",
 5    "*:\\PerfLogs\\*",
 6    "*:\\Users\\Administrator\\Music\\*",
 7    "*:\\Users\\Public\\*",
 8    "*:\\Windows\\Cursors\\*",
 9    "*:\\Windows\\debug\\*",
10    "*:\\Windows\\fonts\\*",
11    "*:\\Windows\\INF\\*",
12    "*:\\Windows\\Media\\*",
13    "*:\\Windows\\Prefetch\\*",
14    "*\\Windows\\repair\\*"
15)
16
17process_name IN (
18    "py.exe",
19    "pypy.exe",
20    "python.exe",
21    "python2*.exe",
22    "python3*.exe",
23    "pythonw.exe"
24)
25
26dest IN (
27    "*.facebook.com",
28    "*.facebook.net",
29    "*.facebook.org",
30    "*.fb.com",
31    "*.fbcd.net",
32    "*.fbsbx.com",
33    "*.fbstatic-a.akamaihd.net",
34    "*.tfbw.net"
35)
36direction = outbound
37
38
39| rename Image as process_path
40
41
42| stats count min(_time) as firstTime
43              max(_time) as lastTime
44
45  by action app dest dest_ip dest_port direction dvc protocol protocol_version
46     process_path process_name process_guid process_id
47     src src_ip src_port transport user vendor_product
48
49
50| `security_content_ctime(firstTime)`
51
52| `security_content_ctime(lastTime)`
53
54| `windows_process_outbound_connection_to_social_media_domain_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 3	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Known False Positives

No false positives have been identified at this time.

Associated Analytic Story

• Braodo Stealer

Intermediate Findings

Threat Objects

References

• https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1