Detect Automated Exfiltration in CrowdStrike LogScale

// Branch 1: Scripting engines with upload or collection+transfer command patterns
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(powershell\.exe|pwsh\.exe|python\.exe|python3\.exe|wscript\.exe|cscript\.exe|cmd\.exe)$/
| CommandLine = /(?i)(UploadFile|UploadData|UploadString|Start-BitsTransfer|Net\.FtpWebRequest|Invoke-WebRequest|Invoke-RestMethod)/
  OR (CommandLine = /(?i)(Get-ChildItem|Compress-Archive|dir\s\/s|\[IO\.File\]::)/ AND CommandLine = /(?i)(curl\s|wget\s|ftp\s-|\ssftp\s)/)
  OR (CommandLine = /(?i)(Get-ChildItem|Compress-Archive)/ AND CommandLine = /(?i)(\\Documents\\|\\Desktop\\|\\AppData\\|\\ProgramData\\|\\temp\\)/)
| eval HasUpload = if(CommandLine = /(?i)(UploadFile|UploadData|Start-BitsTransfer|Net\.FtpWebRequest)/, "true", "false")
| eval HasCollection = if(CommandLine = /(?i)(Get-ChildItem|Compress-Archive|dir\s\/s)/, "true", "false")
| eval HasTransferTool = if(CommandLine = /(?i)(curl\s|wget\s|ftp\s-)/, "true", "false")
| eval SensitivePath = if(CommandLine = /(?i)(\\Documents|\\Desktop|\\AppData|\\ProgramData|\\temp)/, "true", "false")
| table([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentImageFileName, ParentCommandLine, HasUpload, HasCollection, HasTransferTool, SensitivePath])
| sort(timestamp, order=desc)

// Branch 2: Transfer utilities executing upload commands to external targets
| union {
  #event_simpleName=ProcessRollup2
  | ImageFileName = /(?i)(curl\.exe|wget\.exe|certutil\.exe|bitsadmin\.exe|ftp\.exe|sftp\.exe|scp\.exe)$/
  | CommandLine = /(?i)(-T\s|--upload-file|-d\s@|--data-binary\s@|\/upload|\/transfer|ftp:\/\/|sftp:\/\/|ftps:\/\/)/
  | CommandLine != /(?i)(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)/
  | eval IsExternal = "true"
  | table([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentImageFileName, IsExternal])
  | sort(timestamp, order=desc)
}

// Branch 3: Archive tools on sensitive paths correlated with external network connections
| union {
  #event_simpleName=ProcessRollup2
  | ImageFileName = /(?i)(7z\.exe|7za\.exe|winrar\.exe|rar\.exe|zip\.exe|tar\.exe)$/
  | CommandLine = /(?i)(\\Documents|\\Desktop|\\Users|\\AppData|\\ProgramData)/
  | ArchiveComputerName := ComputerName
  | ArchiveTime := timestamp
  | join({
      #event_simpleName=NetworkConnectIP4
      | RemoteAddressPrefix != /^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)/
      | NetComputerName := ComputerName
      | NetTime := timestamp
    }, field=[ArchiveComputerName, NetComputerName], mode=inner)
  | TimeDelta := NetTime - ArchiveTime
  | TimeDelta >= 0
  | TimeDelta <= 300000
  | table([ArchiveTime, ComputerName, UserName, ImageFileName, CommandLine, RemoteAddress, RemotePort, TimeDelta])
  | sort(ArchiveTime, order=desc)
}