Compromised WordPress Sites Weaponized as Malware Distribution Redirectors

// THREAT-Infra-CompromisedWordPressRedirector (T1584.006) - Compromised legitimate web services used as malware distribution redirectors
// Pillar 1: Browser process downloads and then executes a file within minutes of visiting an otherwise-benign site (fake-update pattern)
let SuspiciousDownloadExt = dynamic([".js", ".zip", ".msi", ".exe", ".hta", ".iso"]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (@"\Downloads\", @"\Temp\", @"\AppData\Local\Temp\")
| where FileName has_any (SuspiciousDownloadExt)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| project DownloadTime=Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessParentFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "explorer.exe")
    | where FileName has_any (".js", ".hta", ".msi", ".exe")
    | project ExecTime=Timestamp, DeviceName, ExecFileName=FileName, ExecCommandLine=ProcessCommandLine
  ) on DeviceName
| where ExecTime between (DownloadTime .. DownloadTime + 10m)
| extend SuspicionReason = "DownloadThenExecuteWithinTenMinutes"
| project DownloadTime, ExecTime, DeviceName, FileName, ExecFileName, ExecCommandLine, SuspicionReason
| union (
    // Pillar 2: DNS/HTTP evidence of multi-hop TDS redirect chain terminating off the originally-requested domain within seconds
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
    | summarize HopCount=dcount(RemoteUrl), Hosts=make_set(RemoteUrl, 10), FirstHop=min(Timestamp), LastHop=max(Timestamp) by DeviceName, InitiatingProcessId
    | where HopCount >= 4 and (LastHop - FirstHop) < 15s
    | extend DownloadTime=FirstHop, ExecTime=LastHop, FileName=strcat("MultiHopChain:", tostring(HopCount)), ExecFileName="", ExecCommandLine=strcat_array(Hosts, " -> "), SuspicionReason="RapidMultiHopRedirectChain"
    | project DownloadTime, ExecTime, DeviceName, FileName, ExecFileName, ExecCommandLine, SuspicionReason
)
| sort by DownloadTime desc

| union
[
  search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  TargetFilename IN ("*\\Downloads\\*.js", "*\\Downloads\\*.zip", "*\\Downloads\\*.msi", "*\\Downloads\\*.exe", "*\\Downloads\\*.hta", "*\\Temp\\*.js", "*\\Temp\\*.hta")
  Image IN ("*\\chrome.exe", "*\\msedge.exe", "*\\firefox.exe")
  | eval DownloadTime=_time
  | table DownloadTime, host, TargetFilename, Image
  | join type=inner host
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      ParentImage IN ("*\\chrome.exe", "*\\msedge.exe", "*\\firefox.exe", "*\\explorer.exe")
      Image IN ("*.js", "*.hta", "*.msi", "*.exe")
      | eval ExecTime=_time
      | table ExecTime, host, Image, CommandLine ]
  | where (ExecTime - DownloadTime) >= 0 AND (ExecTime - DownloadTime) <= 600
  | eval SuspicionReason="DownloadThenExecuteWithinTenMinutes"
  | table DownloadTime, ExecTime, host, TargetFilename, Image, CommandLine, SuspicionReason
]
[
  search index=proxy sourcetype="*proxy*"
  | eval Process=coalesce(app,"browser")
  | bin _time span=15s
  | stats dc(url) as HopCount, values(url) as Hosts, min(_time) as FirstHop, max(_time) as LastHop by host, _time
  | where HopCount >= 4
  | eval SuspicionReason="RapidMultiHopRedirectChain"
  | table FirstHop, LastHop, host, HopCount, Hosts, SuspicionReason
]
| sort - DownloadTime

sequence by host.name with maxspan=10m
[
  file where event.type == "creation" and
    file.extension : ("js", "zip", "msi", "exe", "hta", "iso") and
    file.path : ("*\\Downloads\\*", "*\\Temp\\*") and
    process.name : ("chrome.exe", "msedge.exe", "firefox.exe")
]
[
  process where event.type == "start" and
    process.parent.name : ("chrome.exe", "msedge.exe", "firefox.exe", "explorer.exe") and
    process.name : ("wscript.exe", "cscript.exe", "powershell.exe", "mshta.exe", "*.exe")
]

SELECT
  DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip, "Image" AS Process, "TargetFilename" AS DownloadedFile,
  "CommandLine",
  CASE
    WHEN "TargetFilename" ILIKE '%.js' OR "TargetFilename" ILIKE '%.hta' THEN 80
    ELSE 60
  END AS RiskScore
FROM events
WHERE
  ("TargetFilename" ILIKE '%\\Downloads\\%' OR "TargetFilename" ILIKE '%\\Temp\\%')
  AND "Image" ILIKE ANY ('%chrome.exe%','%msedge.exe%','%firefox.exe%')
  AND LOGSOURCETYPENAME(devicetype) ILIKE '%sysmon%'
ORDER BY RiskScore DESC
LAST 24 HOURS

_sourceCategory=*sysmon*
| json auto
| where (TargetFilename matches "*\\Downloads\\*" or TargetFilename matches "*\\Temp\\*")
| where Image matches "*chrome.exe*" or Image matches "*msedge.exe*" or Image matches "*firefox.exe*"
| eval IsScriptExt = if(matches(TargetFilename, "\.(js|hta)$"), "true", "false")
| eval RiskScore = if(IsScriptExt = "true", 80, 60)
| stats count as DownloadCount, values(TargetFilename) as SampleFiles by _sourceHost, Image, RiskScore
| sort by RiskScore desc

rule compromised_web_service_redirector {
  meta:
    author = "Detection Engineering"
    description = "Detects browser download-then-execute pattern consistent with a compromised legitimate site serving a fake-update or fake-document lure"
    severity = "HIGH"
    confidence = "medium"
    mitre_attack = "T1584.006"
    reference = "https://attack.mitre.org/techniques/T1584/006/"

  events:
    $download.metadata.event_type = "FILE_CREATION"
    $download.target.file.full_path = /(?i)\\(Downloads|Temp)\\.*\.(js|hta|msi|exe|zip)$/
    $download.principal.process.file.full_path = /(?i)(chrome|msedge|firefox)\.exe/

    $exec.metadata.event_type = "PROCESS_LAUNCH"
    $exec.principal.process.file.full_path = /(?i)(wscript|cscript|powershell|mshta)\.exe/
    $exec.target.process.command_line = $download.target.file.full_path

    $download.target.asset.hostname = $exec.target.asset.hostname

  condition:
    $download and $exec
}

#event_simpleName=FileWritten
| FileName=/\.(js|hta|msi|exe|zip)$/i
| FilePath=/(Downloads|Temp)/i
| ImageFileName=/(chrome|msedge|firefox)\.exe$/i
| join(
    {
      #event_simpleName=ProcessRollup2
      | ImageFileName=/(wscript|cscript|powershell|mshta)\.exe$/i
    },
    field=[aid], key=[aid], mode=inner, include=[CommandLine, ImageFileName, "#timestamp"]
  )
| ExecDeltaSeconds := ("#timestamp" - timestamp) / 1000
| test(ExecDeltaSeconds >= 0 and ExecDeltaSeconds <= 600)
| table([ComputerName, FileName, ImageFileName, CommandLine, ExecDeltaSeconds])
| sort(ExecDeltaSeconds)