Upload Malware

let SuspiciousStagingDomains = dynamic([
    // IPFS gateways
    "ipfs.io", "cloudflare-ipfs.com", "gateway.ipfs.io", "dweb.link",
    "ipfs.fleek.co", "nftstorage.link", "w3s.link",
    // Discord CDN (widely abused for malware staging)
    "cdn.discordapp.com", "media.discordapp.net", "attachments.discordapp.net",
    // Paste sites
    "pastebin.com", "paste.ee", "hastebin.com", "ghostbin.co", "controlc.com",
    "rentry.co", "pastecode.io",
    // Anonymous file sharing
    "transfer.sh", "file.io", "gofile.io", "anonfiles.com", "pixeldrain.com",
    "0x0.st", "catbox.moe", "litterbox.catbox.moe",
    // Telegram CDN
    "t.me", "cdn1.telegram-cdn.org", "cdn4.telegram-cdn.org"
]);
let SuspiciousExtensions = dynamic([
    ".exe", ".dll", ".ps1", ".vbs", ".bat", ".cmd", ".hta",
    ".msi", ".lnk", ".scr", ".pif", ".cpl", ".jar"
]);
let DownloadLOLBins = dynamic([
    "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe",
    "mshta.exe", "wscript.exe", "cscript.exe", "regsvr32.exe",
    "msiexec.exe", "esentutl.exe", "desktopimgdownldr.exe"
]);
// Branch 1: LOLBin or scripting engine downloading from suspicious staging platforms
let StagingDomainDownloads = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType in ("ConnectionSuccess", "HttpConnectionInspected")
| where RemoteUrl has_any (SuspiciousStagingDomains)
| where InitiatingProcessFileName has_any (DownloadLOLBins)
    or InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, RemoteUrl, RemoteIP, RemotePort,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessParentFileName, DetectionBranch="LOLBin_StagingDomain";
// Branch 2: Executable files written to high-risk paths by download processes
let SuspiciousFileDrops = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where InitiatingProcessFileName has_any (DownloadLOLBins)
    or InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe",
       "chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe")
| where FolderPath has_any (
    "\\Downloads\\", "\\Temp\\", "\\AppData\\Local\\Temp\\",
    "\\AppData\\Roaming\\", "\\ProgramData\\", "\\Users\\Public\\"
  )
| where FileName has_any (SuspiciousExtensions)
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessParentFileName, DetectionBranch="SuspiciousFileDrop";
// Branch 3: PowerShell or scripting engines contacting IPFS or blockchain RPC endpoints
let IPFSBlockchainAccess = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("ipfs.io", "cloudflare-ipfs.com", "dweb.link", "w3s.link")
    or RemotePort in (8545, 8546, 30303)  // Ethereum RPC / P2P ports
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe",
       "wscript.exe", "cscript.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, RemoteUrl, RemoteIP, RemotePort,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessParentFileName, DetectionBranch="IPFS_Blockchain";
union StagingDomainDownloads, SuspiciousFileDrops, IPFSBlockchainAccess
| sort by Timestamp desc

index=proxy OR index=web OR index=network
  sourcetype="bluecoat:proxysg:access:syslog" OR sourcetype="squid" OR sourcetype="stream:http" OR sourcetype="cisco:esa:http"
| eval domain=lower(coalesce(cs_host, dest_host, url_domain, host))
| eval url_lower=lower(coalesce(cs_uri_stem, url, uri_path))
| eval content_type=lower(coalesce(cs_mime_type, content_type, mime_type))
| eval staging_platform=case(
    match(domain, "(ipfs\.io|cloudflare-ipfs\.com|gateway\.ipfs\.io|dweb\.link|w3s\.link|nftstorage\.link)"), "IPFS_Gateway",
    match(domain, "(cdn\.discordapp\.com|media\.discordapp\.net|attachments\.discordapp\.net)"), "Discord_CDN",
    match(domain, "(pastebin\.com|paste\.ee|hastebin\.com|ghostbin\.co|rentry\.co|controlc\.com|pastecode\.io)"), "Paste_Site",
    match(domain, "(transfer\.sh|file\.io|gofile\.io|anonfiles\.com|pixeldrain\.com|0x0\.st|catbox\.moe)"), "AnonFileShare",
    match(domain, "(cdn1\.telegram-cdn\.org|cdn4\.telegram-cdn\.org)"), "Telegram_CDN",
    true(), null()
  )
| where isnotnull(staging_platform)
| eval executable_content=if(
    match(content_type, "(application/x-msdownload|application/octet-stream|application/x-executable|application/x-dosexec|application/x-msdos-program)")
    OR match(url_lower, "(\.exe|\.dll|\.ps1|\.vbs|\.bat|\.cmd|\.hta|\.msi|\.lnk|\.scr|\.jar)$"),
    1, 0
  )
| eval suspicious_useragent=if(
    match(lower(coalesce(cs_useragent, http_user_agent, useragent)),
    "(powershell|curl|wget|python-requests|go-http|libwww-perl|mshta|wscript|certutil|bitsadmin)"),
    1, 0
  )
| eval suspicion_score=executable_content + suspicious_useragent
| where suspicion_score > 0
| eval alert_context=case(
    executable_content=1 AND suspicious_useragent=1, "Executable download via scripting agent - HIGH",
    executable_content=1, "Executable content type from staging platform",
    suspicious_useragent=1, "Automated downloader accessing staging platform",
    true(), "Staging platform access"
  )
| stats
    count as request_count,
    values(url_lower) as urls,
    values(content_type) as content_types,
    values(coalesce(cs_useragent, http_user_agent, useragent)) as user_agents,
    max(suspicion_score) as max_score,
    values(alert_context) as alert_contexts,
    earliest(_time) as first_seen,
    latest(_time) as last_seen
  by src_ip, domain, staging_platform
| sort - max_score, - request_count

any where process.name : ("curl", "wget", "powershell.exe", "certutil.exe", "bitsadmin.exe") and (process.command_line : ("*.bin", "*.exe", "*.dll", "*.ps1", "*.bat", "*.vbs", "*.hta") or network.direction : "egress" and destination.port in (80, 443) and process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe"))

SELECT sourceip as "SourceIP", destinationip as "DestinationIP", UTF8(payload) as "URL", username as "Username", devicetime as "EventTime", CASE WHEN UTF8(payload) ILIKE '%.exe%' OR UTF8(payload) ILIKE '%.dll%' OR UTF8(payload) ILIKE '%.bin%' THEN 80 WHEN UTF8(payload) ILIKE '%paste%' OR UTF8(payload) ILIKE '%transfer.sh%' OR UTF8(payload) ILIKE '%gofile%' THEN 75 WHEN UTF8(payload) ILIKE '%certutil%' OR UTF8(payload) ILIKE '%bitsadmin%' THEN 70 ELSE 50 END as "RiskScore" FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Proxy', 'Windows', 'Zscaler Internet Access') AND (eventid = 4688 OR destinationport IN (80, 443)) ORDER BY "RiskScore" DESC LAST 24 HOURS

_sourceCategory=endpoint/windows OR _sourceCategory=proxy/access | json auto | where (process_name in ("curl.exe", "wget.exe", "certutil.exe", "bitsadmin.exe", "powershell.exe") and (command_line matches "*.exe" or command_line matches "*.dll" or command_line matches "*.bin")) or (url matches "*transfer.sh*" or url matches "*paste.ee*" or url matches "*gofile.io*") | if(matches(process_name, "*certutil*") and matches(command_line, "*urlcache*"), "High", if(matches(url, "*transfer.sh*") or matches(url, "*gofile.io*"), "High", "Medium")) as RiskLevel | count by src_ip, process_name, RiskLevel | sort by count desc

rule detect_stage_capabilities {
  meta:
    author = "Argus"
    description = "Detects staging of capabilities from external infrastructure"
    severity = "HIGH"
    technique = "T1608"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.target.url, `\.(exe|dll|bin|ps1|bat|vbs|hta|sh|elf)($|\?)`) nocase or
      re.regex($e.target.hostname, `transfer\.sh|paste\.ee|gofile\.io|anonfiles|temp\.sh`) nocase
    )
    $e.principal.process.file.full_path != ""
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /certutil|bitsadmin|curl|wget/i
| CommandHistory = /urlcache|transfer|download|http/i
| case {
    CommandHistory = /\.exe|\.dll|\.bin/i | FileType := "Executable";
    CommandHistory = /\.ps1|\.bat|\.vbs/i | FileType := "Script";
    * | FileType := "Other"
  }
| table([@timestamp, UserName, ComputerName, ImageFileName, CommandHistory, FileType])