Exfiltration Over Alternative Protocol

let ExfilTools = dynamic(["ftp.exe", "curl.exe", "winscp.exe", "pscp.exe", "sftp.exe", "ncftp.exe", "lftp", "wget.exe", "bitsadmin.exe", "robocopy.exe"]);
let SuspiciousFTPPatterns = dynamic(["-T ", "--upload-file", "PUT ", "STOR ", "ftp://", "sftp://", "ftps://"]);
let ExfilPorts = dynamic([21, 22, 25, 465, 587, 989, 990, 2222, 2121]);
// Branch 1: Suspicious exfil tool usage with upload indicators
let ToolBased = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (ExfilTools)
| where ProcessCommandLine has_any (SuspiciousFTPPatterns)
    or ProcessCommandLine has_any ("-o ", "--output", "-F ", "--form", "smtp://", "smtps://", "--mail-from", "--mail-rcpt")
| extend DetectionBranch = "ExfilToolUpload"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch;
// Branch 2: Outbound connections on exfil-relevant ports from non-standard processes
let NetworkBased = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIPType == "Public"
| where RemotePort in (ExfilPorts)
| where InitiatingProcessFileName !in~ ("svchost.exe", "lsass.exe", "services.exe", "System",
         "Outlook.exe", "thunderbird.exe", "filezilla.exe", "winsshd.exe")
| where InitiatingProcessFileName !startswith "MicrosoftEdge"
| summarize BytesSent=sum(SentBytes), Connections=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| where BytesSent > 1048576 or Connections > 10
| extend DetectionBranch = "SuspiciousOutboundPort"
| project FirstSeen, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          RemoteIP, RemotePort, RemoteUrl, BytesSent, Connections, DetectionBranch;
// Branch 3: DNS tunneling — long subdomains or high DNS query volume to single domain
let DNSTunneling = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "DnsQueryResponse" or ActionType == "ConnectionSuccess"
| where RemotePort == 53
| where RemoteIPType == "Public"
| extend QueryLength = strlen(RemoteUrl)
| where QueryLength > 50
| summarize QueryCount=count(), MaxQueryLen=max(QueryLength), Domains=make_set(RemoteUrl, 20)
    by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where QueryCount > 20 or MaxQueryLen > 100
| extend DetectionBranch = "DNSTunnelingSuspect"
| project Timestamp, DeviceName, InitiatingProcessFileName, QueryCount, MaxQueryLen, Domains, DetectionBranch;
ToolBased
| union NetworkBased
| union DNSTunneling
| sort by Timestamp desc

| union
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\ftp.exe" OR Image="*\\curl.exe" OR Image="*\\winscp.exe" OR Image="*\\pscp.exe"
   OR Image="*\\sftp.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\robocopy.exe")
| eval CommandLine=lower(CommandLine)
| eval UploadFlag=if(match(CommandLine, "(-t\s|--upload-file|\sput\s|\sstor\s|ftp://|sftp://|ftps://|-f\s|--form|smtp://|--mail-from|--mail-rcpt)"), 1, 0)
| where UploadFlag=1
| eval DetectionBranch="ExfilToolUpload"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionBranch
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="172.17.*" OR DestinationIp="172.18.*"
       OR DestinationIp="172.19.*" OR DestinationIp="172.20.*" OR DestinationIp="172.21.*" OR DestinationIp="172.22.*"
       OR DestinationIp="172.23.*" OR DestinationIp="172.24.*" OR DestinationIp="172.25.*" OR DestinationIp="172.26.*"
       OR DestinationIp="172.27.*" OR DestinationIp="172.28.*" OR DestinationIp="172.29.*" OR DestinationIp="172.30.*"
       OR DestinationIp="172.31.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
  (DestinationPort=21 OR DestinationPort=22 OR DestinationPort=25 OR DestinationPort=465
   OR DestinationPort=587 OR DestinationPort=989 OR DestinationPort=990 OR DestinationPort=2121)
  NOT (Image="*\\Outlook.exe" OR Image="*\\thunderbird.exe" OR Image="*\\filezilla.exe"
       OR Image="*\\svchost.exe" OR Image="*\\lsass.exe")
| stats sum(eval(if(isnum(SourcePort),1,0))) as Connections, values(DestinationIp) as DestIPs, values(DestinationPort) as DestPorts
    by host, User, Image, CommandLine, DestinationIp, DestinationPort
| where Connections > 5
| eval DetectionBranch="SuspiciousOutboundPort"
| table host, User, Image, CommandLine, DestIPs, DestPorts, Connections, DetectionBranch
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
  NOT (QueryName="*.microsoft.com" OR QueryName="*.windows.com" OR QueryName="*.google.com"
       OR QueryName="*.amazon.com" OR QueryName="*.cloudfront.net")
| eval QueryLen=len(QueryName)
| where QueryLen > 50
| stats count as DNSQueryCount, max(QueryLen) as MaxQueryLen, values(QueryName) as Domains
    by host, User, Image, bin(_time, 3600)
| where DNSQueryCount > 20 OR MaxQueryLen > 100
| eval DetectionBranch="DNSTunnelingSuspect"
| table _time, host, User, Image, DNSQueryCount, MaxQueryLen, Domains, DetectionBranch
]

sequence by host.name with maxspan=1h
  [process where event.type == "start" and
    process.name in~ ("ftp.exe", "curl.exe", "winscp.exe", "pscp.exe", "sftp.exe", "ncftp.exe", "wget.exe", "bitsadmin.exe", "robocopy.exe") and
    (
      process.args : ("-T", "--upload-file", "PUT", "STOR", "ftp://*", "sftp://*", "ftps://*", "-F", "--form", "smtp://*", "--mail-from", "--mail-rcpt")
    )
  ]
  [network where event.type == "connection" and
    destination.port in (21, 22, 25, 465, 587, 989, 990, 2121, 2222) and
    not destination.ip : ("10.*", "172.16.*", "172.17.*", "172.18.*", "172.19.*", "172.20.*", "172.21.*", "172.22.*", "172.23.*", "172.24.*", "172.25.*", "172.26.*", "172.27.*", "172.28.*", "172.29.*", "172.30.*", "172.31.*", "192.168.*", "127.*")
  ]

// Branch 2: High-volume DNS queries suggesting tunneling
sequence by host.name, process.name with maxspan=1h
  [dns where event.type == "protocol" and
    dns.question.name : "*" and
    string_length(dns.question.name) > 50 and
    not dns.question.name : ("*.microsoft.com", "*.windows.com", "*.google.com", "*.amazon.com", "*.cloudfront.net")
  ] with runs=20

-- Branch 1: Exfil tool with upload indicators
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip,
  username,
  "Process Name",
  "Command",
  'ExfilToolUpload' AS DetectionBranch
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 14, 352)
  AND QIDNAME(qid) LIKE '%Process Create%'
  AND (
    LOWER("Process Name") LIKE '%ftp.exe%'
    OR LOWER("Process Name") LIKE '%curl.exe%'
    OR LOWER("Process Name") LIKE '%winscp.exe%'
    OR LOWER("Process Name") LIKE '%pscp.exe%'
    OR LOWER("Process Name") LIKE '%sftp.exe%'
    OR LOWER("Process Name") LIKE '%bitsadmin.exe%'
    OR LOWER("Process Name") LIKE '%robocopy.exe%'
  )
  AND (
    LOWER("Command") LIKE '%-t %'
    OR LOWER("Command") LIKE '%--upload-file%'
    OR LOWER("Command") LIKE '% put %'
    OR LOWER("Command") LIKE '%ftp://%'
    OR LOWER("Command") LIKE '%sftp://%'
    OR LOWER("Command") LIKE '%ftps://%'
    OR LOWER("Command") LIKE '%smtp://%'
    OR LOWER("Command") LIKE '%--mail-from%'
    OR LOWER("Command") LIKE '%--mail-rcpt%'
  )
  AND LOGSOURCESTARTTIME(logsourceid) > NOW() - 86400
UNION
-- Branch 2: Outbound connections on exfil ports from non-standard processes
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip,
  username,
  "Process Name",
  "Command",
  'SuspiciousOutboundPort' AS DetectionBranch
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 14, 352)
  AND QIDNAME(qid) LIKE '%Network Connect%'
  AND destinationport IN (21, 22, 25, 465, 587, 989, 990, 2121, 2222)
  AND NOT (destinationip LIKE '10.%' OR destinationip LIKE '192.168.%' OR destinationip LIKE '172.16.%' OR destinationip LIKE '127.%')
  AND NOT (
    LOWER("Process Name") LIKE '%svchost.exe%'
    OR LOWER("Process Name") LIKE '%lsass.exe%'
    OR LOWER("Process Name") LIKE '%outlook.exe%'
    OR LOWER("Process Name") LIKE '%thunderbird.exe%'
    OR LOWER("Process Name") LIKE '%filezilla.exe%'
  )
  AND LOGSOURCESTARTTIME(logsourceid) > NOW() - 86400
UNION
-- Branch 3: DNS tunneling via long subdomain queries
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip,
  username,
  "Process Name",
  "DNS Query" AS "Command",
  'DNSTunnelingSuspect' AS DetectionBranch
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 14, 352)
  AND QIDNAME(qid) LIKE '%DNS%'
  AND STRLEN("DNS Query") > 50
  AND NOT (
    "DNS Query" LIKE '%.microsoft.com'
    OR "DNS Query" LIKE '%.windows.com'
    OR "DNS Query" LIKE '%.google.com'
    OR "DNS Query" LIKE '%.amazon.com'
  )
  AND LOGSOURCESTARTTIME(logsourceid) > NOW() - 86400
ORDER BY EventTime DESC

// Branch 1: Exfil tool with upload indicators (Sysmon Event ID 1)
_sourceCategory=windows/sysmon ("EventID=1" OR "<EventID>1</EventID>")
| parse "<Image>*</Image>" as Image
| parse "<CommandLine>*</CommandLine>" as CommandLine
| parse "<ParentImage>*</ParentImage>" as ParentImage
| parse "<User>*</User>" as User
| parse "<Computer>*</Computer>" as Computer
| where (
    Image matches "*ftp.exe" OR Image matches "*curl.exe" OR Image matches "*winscp.exe"
    OR Image matches "*pscp.exe" OR Image matches "*sftp.exe" OR Image matches "*bitsadmin.exe"
    OR Image matches "*robocopy.exe" OR Image matches "*wget.exe"
  )
| where (
    CommandLine matches "* -T *" OR CommandLine matches "*--upload-file*" OR CommandLine matches "* PUT *"
    OR CommandLine matches "*ftp://*" OR CommandLine matches "*sftp://*" OR CommandLine matches "*ftps://*"
    OR CommandLine matches "*smtp://*" OR CommandLine matches "*--mail-from*" OR CommandLine matches "*--mail-rcpt*"
    OR CommandLine matches "* -F *" OR CommandLine matches "*--form*"
  )
| fields _messagetime, Computer, User, Image, CommandLine, ParentImage
| concat("ExfilToolUpload") as DetectionBranch

// Branch 2: Outbound network connections on exfil ports (Sysmon Event ID 3)
// Run as separate query:
// _sourceCategory=windows/sysmon ("EventID=3" OR "<EventID>3</EventID>")
// | parse "<DestinationIp>*</DestinationIp>" as DestinationIp
// | parse "<DestinationPort>*</DestinationPort>" as DestinationPort
// | parse "<Image>*</Image>" as Image
// | parse "<User>*</User>" as User
// | parse "<Computer>*</Computer>" as Computer
// | where DestinationPort in ("21","22","25","465","587","989","990","2121","2222")
// | where !( DestinationIp matches "10.*" OR DestinationIp matches "192.168.*" OR DestinationIp matches "172.1[6-9].*" OR DestinationIp matches "172.2[0-9].*" OR DestinationIp matches "172.3[0-1].*" OR DestinationIp matches "127.*")
// | where !( Image matches "*svchost.exe" OR Image matches "*lsass.exe" OR Image matches "*Outlook.exe" OR Image matches "*thunderbird.exe" OR Image matches "*filezilla.exe")
// | timeslice 1h
// | count as Connections by Computer, User, Image, DestinationIp, DestinationPort, _timeslice
// | where Connections > 5
// | concat("SuspiciousOutboundPort") as DetectionBranch

// Branch 3: DNS tunneling — long DNS query names (Sysmon Event ID 22)
// Run as separate query:
// _sourceCategory=windows/sysmon ("EventID=22" OR "<EventID>22</EventID>")
// | parse "<QueryName>*</QueryName>" as QueryName
// | parse "<Image>*</Image>" as Image
// | parse "<User>*</User>" as User
// | parse "<Computer>*</Computer>" as Computer
// | where length(QueryName) > 50
// | where !( QueryName matches "*.microsoft.com" OR QueryName matches "*.windows.com" OR QueryName matches "*.google.com" OR QueryName matches "*.amazon.com" OR QueryName matches "*.cloudfront.net")
// | timeslice 1h
// | count as DNSQueryCount, max(length(QueryName)) as MaxQueryLen by Computer, User, Image, _timeslice
// | where DNSQueryCount > 20 OR MaxQueryLen > 100
// | concat("DNSTunnelingSuspect") as DetectionBranch

rule T1048_ExfilOverAlternativeProtocol {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects exfiltration over alternative protocols including FTP/SFTP/SMTP tool usage with upload indicators, outbound connections on exfil-relevant ports, and DNS tunneling via long subdomain queries."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048"
    severity = "HIGH"
    priority = "HIGH"

  events:
    // Branch 1: Exfil tool with upload command-line indicators
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e1.principal.process.file.full_path, `(?i)(ftp\.exe|curl\.exe|winscp\.exe|pscp\.exe|sftp\.exe|ncftp\.exe|wget\.exe|bitsadmin\.exe|robocopy\.exe)$`)
      )
      and (
        re.regex($e1.principal.process.command_line, `(?i)(\s-T\s|--upload-file|\sPUT\s|\sSTOR\s|ftp://|sftp://|ftps://|\s-F\s|--form|smtp://|smtps://|--mail-from|--mail-rcpt)`)
      )
    )
    or
    // Branch 2: Outbound connection on exfil ports from unexpected process
    (
      $e1.metadata.event_type = "NETWORK_CONNECTION"
      and (
        $e1.target.port = 21
        or $e1.target.port = 22
        or $e1.target.port = 25
        or $e1.target.port = 465
        or $e1.target.port = 587
        or $e1.target.port = 989
        or $e1.target.port = 990
        or $e1.target.port = 2121
        or $e1.target.port = 2222
      )
      and not net.ip_in_range_cidr($e1.target.ip, "10.0.0.0/8")
      and not net.ip_in_range_cidr($e1.target.ip, "172.16.0.0/12")
      and not net.ip_in_range_cidr($e1.target.ip, "192.168.0.0/16")
      and not net.ip_in_range_cidr($e1.target.ip, "127.0.0.0/8")
      and not re.regex($e1.principal.process.file.full_path, `(?i)(svchost\.exe|lsass\.exe|services\.exe|Outlook\.exe|thunderbird\.exe|filezilla\.exe)$`)
    )
    or
    // Branch 3: DNS tunneling via long query names
    (
      $e1.metadata.event_type = "NETWORK_DNS"
      and strings.length($e1.network.dns.questions.name) > 50
      and not re.regex($e1.network.dns.questions.name, `(?i)(microsoft\.com|windows\.com|google\.com|amazon\.com|cloudfront\.net)$`)
    )

  condition:
    $e1
}

// Branch 1: Exfil tool with upload indicators
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(ftp\.exe|curl\.exe|winscp\.exe|pscp\.exe|sftp\.exe|ncftp\.exe|wget\.exe|bitsadmin\.exe|robocopy\.exe)$/
| CommandLine = /(?i)(\s-T\s|--upload-file|\sPUT\s|\sSTOR\s|ftp:\/\/|sftp:\/\/|ftps:\/\/|\s-F\s|--form|smtp:\/\/|smtps:\/\/|--mail-from|--mail-rcpt)/
| rename(field=ComputerName, as="Hostname")
| rename(field=UserName, as="User")
| table(["@timestamp", Hostname, User, ImageFileName, CommandLine, ParentBaseFileName])
| eval DetectionBranch="ExfilToolUpload"

// Branch 2: Outbound connections on exfil ports from non-standard processes
// Run as separate saved search:
// #event_simpleName=NetworkConnectIP4
// | !(RemoteAddressIP4 = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/ )
// | RemotePort in [21, 22, 25, 465, 587, 989, 990, 2121, 2222]
// | !(ImageFileName = /(svchost\.exe|lsass\.exe|services\.exe|Outlook\.exe|thunderbird\.exe|filezilla\.exe)$/i)
// | groupBy([ComputerName, UserName, ImageFileName, RemoteAddressIP4, RemotePort], function=[count(as=Connections), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
// | Connections > 5
// | eval DetectionBranch="SuspiciousOutboundPort"
// | table([FirstSeen, ComputerName, UserName, ImageFileName, RemoteAddressIP4, RemotePort, Connections, DetectionBranch])

// Branch 3: DNS tunneling via long query names
// Run as separate saved search:
// #event_simpleName=DnsRequest
// | DomainName != /(?i)(microsoft\.com|windows\.com|google\.com|amazon\.com|cloudfront\.net)$/
// | DomainName = /^.{51,}/
// | groupBy([ComputerName, UserName, ImageFileName, bucket(field=@timestamp, span=1h)], function=[count(as=DNSQueryCount), max(length(DomainName), as=MaxQueryLen), collect(DomainName, limit=20, as=Domains)])
// | DNSQueryCount > 20 OR MaxQueryLen > 100
// | eval DetectionBranch="DNSTunnelingSuspect"
// | table([@timestamp, ComputerName, UserName, ImageFileName, DNSQueryCount, MaxQueryLen, Domains, DetectionBranch])