File Download From IP URL Via Curl.EXE

 1title: File Download From IP URL Via Curl.EXE
 2id: 9cc85849-3b02-4cb5-b371-3a1ff54f2218
 3related:
 4    - id: 5cb299fc-5fb1-4d07-b989-0644c68b6043
 5      type: similar
 6status: experimental
 7description: Detects file downloads directly from IP address URL using curl.exe
 8references:
 9    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
10    - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
11    - https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt
12author: Nasreddine Bencherchali (Nextron Systems)
13date: 2023/10/18
14tags:
15    - attack.execution
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection_img:
21        - Image|endswith: '\curl.exe'
22        - OriginalFileName: 'curl.exe'
23    selection_ip:
24        CommandLine|re: '://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
25    selection_http:
26        CommandLine|contains: 'http'
27    selection_flag:
28        CommandLine|contains:
29            - ' -O'  # covers the alias for --remote-name and --output
30            - '--remote-name'
31            - '--output'
32    filter_main_ext:
33        # Note: This filter exists to avoid duplication with 5cb299fc-5fb1-4d07-b989-0644c68b6043
34        CommandLine|endswith:
35            - '.bat'
36            - '.bat"'
37            - '.dat'
38            - '.dat"'
39            - '.dll'
40            - '.dll"'
41            - '.exe'
42            - '.exe"'
43            - '.gif'
44            - '.gif"'
45            - '.hta'
46            - '.hta"'
47            - '.jpeg'
48            - '.jpeg"'
49            - '.log'
50            - '.log"'
51            - '.msi'
52            - '.msi"'
53            - '.png'
54            - '.png"'
55            - '.ps1'
56            - '.ps1"'
57            - '.psm1'
58            - '.psm1"'
59            - '.vbe'
60            - '.vbe"'
61            - '.vbs'
62            - '.vbs"'
63            - ".bat'"
64            - ".dat'"
65            - ".dll'"
66            - ".exe'"
67            - ".gif'"
68            - ".hta'"
69            - ".jpeg'"
70            - ".log'"
71            - ".msi'"
72            - ".png'"
73            - ".ps1'"
74            - ".psm1'"
75            - ".vbe'"
76            - ".vbs'"
77    condition: all of selection_* and not 1 of filter_main_*
78falsepositives:
79    - Unknown
80level: medium

References

• FIN7 tradecraft seen in attacks against Veeam backup servers

  

  WithSecure Intelligence identified attacks which occurred in late March 2023 against internet-facing servers running Veeam Backup & Replication software. Our research indicates that the intrusion set used in these attacks has overlaps with those attributed to the FIN7 activity group. It is likely that initial access & execution was achieved through a recently patched Veeam Backup & Replication vulnerability, CVE-2023-27532.

  
  Read More

• iocs/FIN7VEEAM/iocs.csv at 344203de742bb7e68bd56618f66d34be95a9f9fc · WithSecureLabs/iocs

  

  Contribute to WithSecureLabs/iocs development by creating an account on GitHub.

  
  Read More

• IcedID/icedID_09.28.2023.txt at 8dd1e218460db4f750d955b4c65b2f918a1db906 · pr0xylife/IcedID

  

  Contribute to pr0xylife/IcedID development by creating an account on GitHub.

  
  Read More

Related rules

• File Download From IP Based URL Via CertOC.EXE
• Suspicious File Download From IP Via Curl.EXE
• PowerShell Script Execution Policy Enabled
• Abusable DLL Potential Sideloading From Suspicious Location
• Adwind RAT / JRAT