Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE

 1title: Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
 2id: b6e04788-29e1-4557-bb14-77f761848ab8
 3status: experimental
 4description: Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe
 5references:
 6    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
 7    - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
 8    - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
 9    - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2024/02/23
12tags:
13    - attack.execution
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection_img:
19        - Image|endswith:
20              - '\powershell.exe'
21              - '\pwsh.exe'
22        - OriginalFileName:
23              - 'PowerShell.EXE'
24              - 'pwsh.dll'
25    selection_websites:
26        CommandLine|contains:
27            # Note: You might want to baseline the github domain before including it
28            # - '.githubusercontent.com'       # Includes both gists and github repositories / Michael Haag (idea).
29            - 'anonfiles.com'
30            - 'cdn.discordapp.com'
31            - 'cdn.discordapp.com/attachments/'
32            - 'ddns.net'
33            - 'dl.dropboxusercontent.com'
34            - 'ghostbin.co'
35            - 'glitch.me'
36            - 'gofile.io'
37            - 'hastebin.com'
38            - 'mediafire.com'
39            - 'mega.nz'
40            - 'onrender.com'
41            - 'paste.ee'
42            - 'pastebin.com'
43            - 'pastebin.pl'
44            - 'pastetext.net'
45            - 'privatlab.com'
46            - 'privatlab.net'
47            - 'send.exploit.in'
48            - 'sendspace.com'
49            - 'storage.googleapis.com'
50            - 'storjshare.io'
51            - 'supabase.co'
52            - 'temp.sh'
53            - 'transfer.sh'
54            - 'ufile.io'
55    selection_download:
56        CommandLine|contains:
57            - '.DownloadString('
58            - '.DownloadFile('
59            - 'Invoke-WebRequest '
60            - 'iwr '
61            - 'wget '
62    condition: all of selection_*
63falsepositives:
64    - Unknown
65level: high

References

• FIN7 tradecraft seen in attacks against Veeam backup servers

  

  WithSecure Intelligence identified attacks which occurred in late March 2023 against internet-facing servers running Veeam Backup & Replication software. Our research indicates that the intrusion set used in these attacks has overlaps with those attributed to the FIN7 activity group. It is likely that initial access & execution was achieved through a recently patched Veeam Backup & Replication vulnerability, CVE-2023-27532.

  
  Read More

• iocs/FIN7VEEAM/iocs.csv at 344203de742bb7e68bd56618f66d34be95a9f9fc · WithSecureLabs/iocs

  

  Contribute to WithSecureLabs/iocs development by creating an account on GitHub.

  
  Read More

• https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/

  
  Read More

• SlashAndGrab: ScreenConnect Post-Exploitation in the Wild (CVE-2024-1709 & CVE-2024-1708)

  

  Adversaries have been VERY busy in the wake of the ScreenConnect vulnerabilities (CVE-2024-1709 & CVE-2024-1708). Here’s all the post-exploitation details, tradecraft, and tactics we’ve observed so far!

  
  Read More

Related rules

• CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry
• Potential CobaltStrike Service Installations - Registry
• Potentially Suspicious Electron Application CommandLine
• Atexec.py Execution
• Bypassing Security Controls - Command Shell