Detect Relocate Malware in Elastic Security
Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may be combined with file deletion to clean up older artifacts. Adversaries may rename payloads to blend into the local environment, target file/path exclusions (such as AV exclusion directories), or position payloads in persistence-related directories. Moving payloads does not alter the Creation timestamp, evading detection logic reliant on file creation time modifications.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1070 Indicator Removal
- Sub-technique
- T1070.010 Relocate Malware
- Canonical reference
- https://attack.mitre.org/techniques/T1070/010/
Elastic Detection Query
any where
(
event.category == "process" and
host.os.type == "windows" and
process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "xcopy.exe", "robocopy.exe") and
(
process.command_line like~ "* copy *" or
process.command_line like~ "*xcopy *" or
process.command_line like~ "*robocopy *" or
process.command_line like~ "*Copy-Item*" or
process.command_line like~ "*Move-Item*" or
process.command_line like~ "* move *" or
process.command_line like~ "*Rename-Item*"
) and
(
process.command_line like~ "*.exe*" or
process.command_line like~ "*.dll*" or
process.command_line like~ "*.bat*" or
process.command_line like~ "*.ps1*" or
process.command_line like~ "*.vbs*" or
process.command_line like~ "*.hta*" or
process.command_line like~ "*.cmd*" or
process.command_line like~ "*.scr*" or
process.command_line like~ "*.pif*"
)
) or
(
event.category == "file" and
host.os.type == "windows" and
event.action in~ ("creation", "rename") and
(
file.path like~ "*\\AppData\\Roaming\\*" or
file.path like~ "*\\AppData\\Local\\Temp\\*" or
file.path like~ "*\\ProgramData\\*" or
file.path like~ "*\\Windows\\Temp\\*" or
file.path like~ "*\\Users\\Public\\*" or
file.path like~ "*\\Windows\\System32\\*" or
file.path like~ "*\\Windows\\SysWOW64\\*" or
file.path like~ "*\\Recycle*"
) and
file.extension in~ ("exe", "dll", "bat", "ps1", "vbs", "js", "hta", "cmd", "scr", "cpl", "pif") and
process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "xcopy.exe", "robocopy.exe", "explorer.exe", "wscript.exe", "cscript.exe", "mshta.exe")
)Detects T1070.010 malware relocation using two complementary branches: (1) process events where cmd.exe, PowerShell, xcopy, or robocopy issues a copy, move, or rename command referencing an executable file extension; (2) file creation or rename events in commonly abused staging directories initiated by LOLBin processes. Covers Elastic Endpoint process and file telemetry as well as Winlogbeat-forwarded Sysmon EventID 1 and EventID 11.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators using robocopy or xcopy to deploy or migrate software packages to ProgramData or System32 during sanctioned maintenance windows, which will satisfy both the copy-command and suspicious-path conditions simultaneously
- Software installers (MSI, NSIS, Inno Setup) that invoke cmd.exe or PowerShell child processes to stage executable files in AppData or ProgramData as part of legitimate application installation workflows
- Endpoint Detection and Response or antivirus products that move quarantined payloads to Temp or Recycle directories, generating file creation events attributed to their own process name which may itself match the LOLBin allowlist
Other platforms for T1070.010
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Executable to AppData Temp Directory Using cmd.exe
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'copy C:\Windows\System32\calc.exe' and 'svchost32.exe'. Sysmon Event ID 11: File Create with TargetFilename=%APPDATA%\Local\Temp\svchost32.exe, Image=cmd.exe. DeviceFileEvents: ActionType=FileCreated, FileName=svchost32.exe, FolderPath contains AppData\Local\Temp.
- Test 2Relocate Payload Using PowerShell Copy-Item to ProgramData
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Copy-Item' and 'ProgramData'. Sysmon Event ID 11: File Create with TargetFilename=C:\ProgramData\WindowsUpdate\wuauclt_helper.exe, Image=powershell.exe. DeviceProcessEvents: ProcessCommandLine has 'Copy-Item' and '.exe'. DeviceFileEvents: ActionType=FileCreated in ProgramData path.
- Test 3Move and Delete Original Payload Simulating Evidence Cleanup
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with full copy-and-delete command line. Sysmon Event ID 11: File Create for %TEMP%\dropped_invoice.exe and %APPDATA%\Microsoft\Windows\helper_svc.exe. Sysmon Event ID 23: File Delete for %TEMP%\dropped_invoice.exe. DeviceFileEvents: ActionType=FileCreated (helper_svc.exe in AppData\Microsoft\Windows) and ActionType=FileDeleted (dropped_invoice.exe in Temp).
- Test 4Rename and Relocate Payload Using xcopy to Windows Temp
Expected signal: Sysmon Event ID 1: Process Create with Image=xcopy.exe, CommandLine containing 'calc.exe' and 'C:\Windows\Temp\msupdate_kb.exe'. Sysmon Event ID 11: File Create with TargetFilename=C:\Windows\Temp\msupdate_kb.exe, Image=xcopy.exe. DeviceProcessEvents: FileName=xcopy.exe, ProcessCommandLine has .exe extension and Windows\Temp path.
References (9)
- https://attack.mitre.org/techniques/T1070/010/
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
- https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.010/T1070.010.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file
- https://www.sans.org/white-papers/39870/
Unlock Pro Content
Get the full detection package for T1070.010 including response playbook, investigation guide, and atomic red team tests.