|
| 1 | +[metadata] |
| 2 | +creation_date = "2025/06/30" |
| 3 | +integration = ["endpoint", "system", "windows", "auditd_manager", "m365_defender", "crowdstrike", "sentinel_one_cloud_funnel"] |
| 4 | +maturity = "production" |
| 5 | +updated_date = "2025/06/30" |
| 6 | + |
| 7 | +[rule] |
| 8 | +author = ["Elastic"] |
| 9 | +description = """ |
| 10 | +Identifies process execution events where the command line value contains a long sequence of whitespace characters or |
| 11 | +multiple occurrences of contiguous whitespace. Attackers may attempt to evade signature-based detections by padding |
| 12 | +their malicious command with unnecessary whitespace characters. These observations should be investigated for malicious |
| 13 | +behavior. |
| 14 | +""" |
| 15 | +from = "now-9m" |
| 16 | +language = "esql" |
| 17 | +license = "Elastic License v2" |
| 18 | +name = "Command Line Obfuscation via Whitespace Padding" |
| 19 | +note = """## Triage and analysis |
| 20 | +
|
| 21 | +### Investigating Command Line Obfuscation via Whitespace Padding |
| 22 | +
|
| 23 | +This rule identifies process execution events where the command line value contains a long sequence of whitespace |
| 24 | +characters or multiple occurrences of contiguous whitespace. Attackers may attempt to evade signature-based detections |
| 25 | +by padding their malicious command with unnecessary whitespace characters. |
| 26 | +
|
| 27 | +#### Possible investigation steps |
| 28 | +
|
| 29 | +- Analyze the command line of the process in question for evidence of malicious code execution. |
| 30 | +- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files |
| 31 | +for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures. |
| 32 | +- Investigate other alerts associated with the user/host during the past 48 hours. |
| 33 | +- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file |
| 34 | +modifications, and any spawned child processes. |
| 35 | +- Retrieve the process executable and determine if it is malicious: |
| 36 | + - Use a private sandboxed malware analysis system to perform analysis. |
| 37 | + - Observe and collect information about the following activities: |
| 38 | + - Attempts to contact external domains and addresses. |
| 39 | + - File and registry access, modification, and creation activities. |
| 40 | + - Service creation and launch activities. |
| 41 | + - Scheduled tasks creation. |
| 42 | + - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values. |
| 43 | + - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. |
| 44 | +
|
| 45 | +### False positive analysis |
| 46 | +
|
| 47 | +- Alerts derived from this rule are not inherently malicious. Analysts can dismiss the alert if they don't find enough |
| 48 | +evidence of further suspicious activity. |
| 49 | +
|
| 50 | +### Response and remediation |
| 51 | +
|
| 52 | +- Initiate the incident response process based on the outcome of the triage. |
| 53 | +- Isolate the involved host to prevent further post-compromise behavior. |
| 54 | +- If the triage identified malware, search the environment for additional compromised hosts. |
| 55 | + - Implement temporary network rules, procedures, and segmentation to contain the malware. |
| 56 | + - Stop suspicious processes. |
| 57 | + - Immediately block the identified indicators of compromise (IoCs). |
| 58 | + - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that |
| 59 | + attackers could use to reinfect the system. |
| 60 | +- Remove the malicious certificate from the root certificate store. |
| 61 | +- Remove and block malicious artifacts identified during triage. |
| 62 | +- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and |
| 63 | +malware components. |
| 64 | +- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are |
| 65 | +identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business |
| 66 | +systems, and web services. |
| 67 | +- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. |
| 68 | +- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the |
| 69 | +mean time to respond (MTTR). |
| 70 | +""" |
| 71 | +risk_score = 47 |
| 72 | +rule_id = "5a876e0d-d39a-49b9-8ad8-19c9b622203b" |
| 73 | +severity = "medium" |
| 74 | +tags = [ |
| 75 | + "Domain: Endpoint", |
| 76 | + "OS: Windows", |
| 77 | + "OS: macOS", |
| 78 | + "OS: Linux", |
| 79 | + "Use Case: Threat Detection", |
| 80 | + "Tactic: Defense Evasion", |
| 81 | + "Tactic: Execution", |
| 82 | + "Resources: Investigation Guide" |
| 83 | +] |
| 84 | +timestamp_override = "event.ingested" |
| 85 | +type = "esql" |
| 86 | + |
| 87 | +query = ''' |
| 88 | +FROM logs-* metadata _id, _version, _index |
| 89 | +| where event.category == "process" and event.type == "start" and event.action != "fork" |
| 90 | +// more than 100 spaces in process.command_line |
| 91 | +| eval multi_spaces = LOCATE(process.command_line, space(100)) |
| 92 | +| where multi_spaces > 0 |
| 93 | +| keep user.name, host.id, host.name, process.command_line, process.executable, process.parent.executable |
| 94 | +''' |
| 95 | + |
| 96 | + |
| 97 | +[[rule.threat]] |
| 98 | +framework = "MITRE ATT&CK" |
| 99 | +[[rule.threat.technique]] |
| 100 | +id = "T1027" |
| 101 | +name = "Obfuscated Files or Information" |
| 102 | +reference = "https://attack.mitre.org/techniques/T1027/" |
| 103 | + |
| 104 | +[[rule.threat.technique]] |
| 105 | +id = "T1140" |
| 106 | +name = "Deobfuscate/Decode Files or Information" |
| 107 | +reference = "https://attack.mitre.org/techniques/T1140/" |
| 108 | + |
| 109 | + |
| 110 | +[rule.threat.tactic] |
| 111 | +id = "TA0005" |
| 112 | +name = "Defense Evasion" |
| 113 | +reference = "https://attack.mitre.org/tactics/TA0005/" |
| 114 | +[[rule.threat]] |
| 115 | +framework = "MITRE ATT&CK" |
| 116 | +[[rule.threat.technique]] |
| 117 | +id = "T1059" |
| 118 | +name = "Command and Scripting Interpreter" |
| 119 | +reference = "https://attack.mitre.org/techniques/T1059/" |
| 120 | +[[rule.threat.technique.subtechnique]] |
| 121 | +id = "T1059.001" |
| 122 | +name = "PowerShell" |
| 123 | +reference = "https://attack.mitre.org/techniques/T1059/001/" |
| 124 | + |
| 125 | + |
| 126 | + |
| 127 | +[rule.threat.tactic] |
| 128 | +id = "TA0002" |
| 129 | +name = "Execution" |
| 130 | +reference = "https://attack.mitre.org/tactics/TA0002/" |
0 commit comments