cscli scenarios install sigmahq/proc_creation_win_susp_data_exfiltration_via_cli1type: trigger2name: sigmahq/proc_creation_win_susp_data_exfiltration_via_cli3description: |4 Detects the use of various CLI utilities exfiltrating data via web requests5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (((evt.Parsed.Image endsWith '\\powershell.exe' || evt.Parsed.Image endsWith '\\pwsh.exe' || evt.Parsed.Image endsWith '\\cmd.exe') && (evt.Parsed.CommandLine contains 'Invoke-WebRequest' || evt.Parsed.CommandLine contains 'iwr ' || evt.Parsed.CommandLine contains 'wget ' || evt.Parsed.CommandLine contains 'curl ') && evt.Parsed.CommandLine contains ' -ur' && evt.Parsed.CommandLine contains ' -me' && evt.Parsed.CommandLine contains ' -b' && evt.Parsed.CommandLine contains ' POST ' || evt.Parsed.Image endsWith '\\curl.exe' && evt.Parsed.CommandLine contains '--ur' && (evt.Parsed.CommandLine contains ' -d ' || evt.Parsed.CommandLine contains ' --data ') || evt.Parsed.Image endsWith '\\wget.exe' && (evt.Parsed.CommandLine contains '--post-data' || evt.Parsed.CommandLine contains '--post-file')) && (evt.Parsed.CommandLine contains 'Get-Content' || evt.Parsed.CommandLine contains 'GetBytes' || evt.Parsed.CommandLine contains 'hostname' || evt.Parsed.CommandLine contains 'ifconfig' || evt.Parsed.CommandLine contains 'ipconfig' || evt.Parsed.CommandLine contains 'net view' || evt.Parsed.CommandLine contains 'netstat' || evt.Parsed.CommandLine contains 'nltest' || evt.Parsed.CommandLine contains 'qprocess' || evt.Parsed.CommandLine contains 'sc query' || evt.Parsed.CommandLine contains 'systeminfo' || evt.Parsed.CommandLine contains 'tasklist' || evt.Parsed.CommandLine contains 'ToBase64String' || evt.Parsed.CommandLine contains 'whoami' || evt.Parsed.CommandLine contains 'type ' && evt.Parsed.CommandLine contains ' > ' && evt.Parsed.CommandLine contains ' C:\\'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1059.0011516 label: "Potential Data Exfiltration Activity Via CommandLine Tools"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324