Drive-by Target

let BrowserProcesses = dynamic(["chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "brave.exe", "opera.exe", "microsoftedge.exe"]);
let SuspiciousChildProcesses = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe", "wmic.exe", "curl.exe", "pcalua.exe", "msbuild.exe"]);
// Sub-query 1: Browser spawning suspicious child processes — strong exploitation indicator
let BrowserExploitSpawn = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (BrowserProcesses)
| where FileName in~ (SuspiciousChildProcesses)
| extend RiskScore = case(
    FileName in~ ("powershell.exe", "mshta.exe", "wscript.exe", "cscript.exe"), 3,
    FileName in~ ("rundll32.exe", "regsvr32.exe", "pcalua.exe", "msbuild.exe"), 2,
    FileName in~ ("certutil.exe", "bitsadmin.exe", "schtasks.exe", "wmic.exe", "cmd.exe"), 2,
    1)
| extend DetectionSource = "BrowserSpawnedSuspiciousProcess"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, RiskScore, DetectionSource;
// Sub-query 2: Browser dropping executable content to temp or public directories
let BrowserFileDrop = DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (BrowserProcesses)
| where ActionType == "FileCreated"
| where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\Windows\\Temp\\", "\\Users\\Public\\")
| where FileName endswith ".exe" or FileName endswith ".dll"
    or FileName endswith ".hta" or FileName endswith ".vbs"
    or FileName endswith ".ps1" or FileName endswith ".js"
    or FileName endswith ".bat" or FileName endswith ".cmd"
    or FileName endswith ".scr"
| extend RiskScore = case(
    FileName endswith ".exe" or FileName endswith ".dll", 3,
    FileName endswith ".hta" or FileName endswith ".vbs" or FileName endswith ".ps1", 3,
    FileName endswith ".js" or FileName endswith ".bat" or FileName endswith ".cmd" or FileName endswith ".scr", 2,
    1)
| extend DetectionSource = "BrowserDroppedExecutable"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
          InitiatingProcessFileName, RiskScore, DetectionSource;
union BrowserExploitSpawn, BrowserFileDrop
| sort by RiskScore desc, Timestamp desc

(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\chrome.exe" OR ParentImage="*\\firefox.exe" OR ParentImage="*\\msedge.exe"
   OR ParentImage="*\\iexplore.exe" OR ParentImage="*\\brave.exe" OR ParentImage="*\\opera.exe"
   OR ParentImage="*\\microsoftedge.exe")
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\wscript.exe"
   OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe"
   OR Image="*\\regsvr32.exe" OR Image="*\\schtasks.exe" OR Image="*\\certutil.exe"
   OR Image="*\\bitsadmin.exe" OR Image="*\\msiexec.exe" OR Image="*\\wmic.exe"
   OR Image="*\\msbuild.exe" OR Image="*\\pcalua.exe"))
OR
(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (Image="*\\chrome.exe" OR Image="*\\firefox.exe" OR Image="*\\msedge.exe"
   OR Image="*\\iexplore.exe" OR Image="*\\brave.exe" OR Image="*\\opera.exe")
  (TargetFilename="*\\Temp\\*.exe" OR TargetFilename="*\\Temp\\*.dll"
   OR TargetFilename="*\\Temp\\*.hta" OR TargetFilename="*\\Temp\\*.vbs"
   OR TargetFilename="*\\Temp\\*.ps1" OR TargetFilename="*\\Temp\\*.js"
   OR TargetFilename="*\\Temp\\*.bat" OR TargetFilename="*\\Temp\\*.scr"
   OR TargetFilename="*\\Users\\Public\\*.exe" OR TargetFilename="*\\Users\\Public\\*.dll"))
| eval DetectionType=case(
    EventCode==1, "BrowserSpawnedProcess",
    EventCode==11, "BrowserDroppedFile",
    "Unknown")
| eval RiskScore=case(
    EventCode==1 AND match(Image, "(?i)(powershell\.exe|mshta\.exe|wscript\.exe|cscript\.exe|msbuild\.exe)"), 3,
    EventCode==1 AND match(Image, "(?i)(rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|pcalua\.exe)"), 2,
    EventCode==1, 1,
    EventCode==11 AND match(TargetFilename, "(?i)\.(exe|dll|hta|vbs|ps1)$"), 3,
    EventCode==11 AND match(TargetFilename, "(?i)\.(js|bat|cmd|scr)$"), 2,
    1)
| eval ChildOrFile=coalesce(Image, TargetFilename)
| eval BrowserParent=coalesce(ParentImage, Image)
| table _time, host, User, DetectionType, ChildOrFile, CommandLine, ParentImage, ParentCommandLine, TargetFilename, RiskScore
| sort - RiskScore _time

any where process.name : ("curl", "wget", "powershell.exe", "certutil.exe", "bitsadmin.exe") and (process.command_line : ("*.bin", "*.exe", "*.dll", "*.ps1", "*.bat", "*.vbs", "*.hta") or network.direction : "egress" and destination.port in (80, 443) and process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe"))

SELECT sourceip as "SourceIP", destinationip as "DestinationIP", UTF8(payload) as "URL", username as "Username", devicetime as "EventTime", CASE WHEN UTF8(payload) ILIKE '%.exe%' OR UTF8(payload) ILIKE '%.dll%' OR UTF8(payload) ILIKE '%.bin%' THEN 80 WHEN UTF8(payload) ILIKE '%paste%' OR UTF8(payload) ILIKE '%transfer.sh%' OR UTF8(payload) ILIKE '%gofile%' THEN 75 WHEN UTF8(payload) ILIKE '%certutil%' OR UTF8(payload) ILIKE '%bitsadmin%' THEN 70 ELSE 50 END as "RiskScore" FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Proxy', 'Windows', 'Zscaler Internet Access') AND (eventid = 4688 OR destinationport IN (80, 443)) ORDER BY "RiskScore" DESC LAST 24 HOURS

_sourceCategory=endpoint/windows OR _sourceCategory=proxy/access | json auto | where (process_name in ("curl.exe", "wget.exe", "certutil.exe", "bitsadmin.exe", "powershell.exe") and (command_line matches "*.exe" or command_line matches "*.dll" or command_line matches "*.bin")) or (url matches "*transfer.sh*" or url matches "*paste.ee*" or url matches "*gofile.io*") | if(matches(process_name, "*certutil*") and matches(command_line, "*urlcache*"), "High", if(matches(url, "*transfer.sh*") or matches(url, "*gofile.io*"), "High", "Medium")) as RiskLevel | count by src_ip, process_name, RiskLevel | sort by count desc

rule detect_stage_capabilities {
  meta:
    author = "Argus"
    description = "Detects staging of capabilities from external infrastructure"
    severity = "HIGH"
    technique = "T1608"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.target.url, `\.(exe|dll|bin|ps1|bat|vbs|hta|sh|elf)($|\?)`) nocase or
      re.regex($e.target.hostname, `transfer\.sh|paste\.ee|gofile\.io|anonfiles|temp\.sh`) nocase
    )
    $e.principal.process.file.full_path != ""
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /certutil|bitsadmin|curl|wget/i
| CommandHistory = /urlcache|transfer|download|http/i
| case {
    CommandHistory = /\.exe|\.dll|\.bin/i | FileType := "Executable";
    CommandHistory = /\.ps1|\.bat|\.vbs/i | FileType := "Script";
    * | FileType := "Other"
  }
| table([@timestamp, UserName, ComputerName, ImageFileName, CommandHistory, FileType])