Chunked Multi-Paste Exfiltration to Text Storage Dead Drops

let PasteSites = dynamic([
  "pastebin.com", "hastebin.com", "ghostbin.co", "ghostbin.com",
  "paste.ee", "paste2.org", "dpaste.org", "dpaste.com",
  "sprunge.us", "ix.io", "termbin.com", "controlc.com",
  "0bin.net", "pastie.org", "pasteio.com", "rentry.co"
]);
// Signal 1: local chunking/splitting of a file into sequentially numbered parts shortly before exfil
let ChunkStaging =
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("split", "split.exe") and ProcessCommandLine has_any ("-b", "--bytes", "-l", "--lines"))
   or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Content", "ReadCount", "Split-Path") and ProcessCommandLine has_any ("-ReadCount", "chunk", "part"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal = "LocalFileChunking";
// Signal 2: burst of paste-site uploads from the same device/account within a 15-minute window
let PasteBurst =
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (PasteSites)
| where RemotePort in (80, 443)
| summarize UploadCount = count(),
            TotalBytes = sum(BytesSent),
            Processes = make_set(InitiatingProcessFileName),
            Destinations = make_set(RemoteUrl),
            FirstSeen = min(Timestamp),
            LastSeen = max(Timestamp)
  by DeviceName, AccountName = InitiatingProcessAccountName, bin(Timestamp, 15m)
| where UploadCount >= 3
| extend AvgBytesPerUpload = TotalBytes / UploadCount
| where AvgBytesPerUpload < 1048576
| extend Signal = "BurstPasteUploads";
ChunkStaging
| join kind=leftouter (PasteBurst) on DeviceName, AccountName
| where isnotempty(UploadCount) or Signal == "LocalFileChunking"
| sort by Timestamp desc

| multisearch
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ((Image="*\\split" OR Image="*\\split.exe") AND (CommandLine="*-b*" OR CommandLine="*--bytes*" OR CommandLine="*-l*"))
  OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND CommandLine="*Get-Content*" AND (CommandLine="*ReadCount*" OR CommandLine="*chunk*" OR CommandLine="*part*"))
  | eval Signal="LocalFileChunking"
  | table _time, host, User, Image, CommandLine, Signal ]
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  (DestinationHostname="*pastebin*" OR DestinationHostname="*hastebin*" OR DestinationHostname="*ghostbin*" OR DestinationHostname="*paste.ee*" OR DestinationHostname="*dpaste*" OR DestinationHostname="*sprunge*" OR DestinationHostname="*termbin*" OR DestinationHostname="*ix.io*" OR DestinationHostname="*controlc.com*" OR DestinationHostname="*rentry.co*")
  | bucket _time span=15m
  | stats count as UploadCount, values(DestinationHostname) as Destinations by host, User, _time
  | where UploadCount >= 3
  | eval Signal="BurstPasteUploads" ]
| stats values(Signal) as Signals, values(CommandLine) as Commands, values(Destinations) as Destinations, sum(UploadCount) as TotalUploads by host, User
| where mvcount(Signals) > 0
| sort - TotalUploads

sequence by process.entity_id with maxspan=15m
  [process where event.type == "start" and
     (
       (process.name : ("split") and process.command_line : ("*-b*", "*--bytes*", "*-l*")) or
       (process.name : ("powershell.exe", "pwsh.exe") and process.command_line : "*Get-Content*" and process.command_line : ("*ReadCount*", "*chunk*", "*part*"))
     )
  ]
  [network where event.type == "connection" and
     destination.domain : ("pastebin.com","hastebin.com","ghostbin.co","paste.ee","dpaste.org","dpaste.com","sprunge.us","ix.io","termbin.com","controlc.com","rentry.co")
  ]

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "DestinationHostname" AS PasteHost,
    COUNT(*) AS UploadCount
FROM events
WHERE "DestinationHostname" ILIKE ANY
  ('%pastebin.com%','%hastebin%','%ghostbin%','%paste.ee%','%dpaste%',
   '%sprunge.us%','%ix.io%','%termbin%','%controlc.com%','%rentry.co%')
  AND starttime > NOW() - 86400000
GROUP BY hostname, username, FLOOR(starttime/900000)
HAVING UploadCount >= 3
ORDER BY UploadCount DESC

(_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=3
(DestinationHostname matches "*pastebin*" OR DestinationHostname matches "*hastebin*" OR DestinationHostname matches "*ghostbin*" OR DestinationHostname matches "*paste.ee*" OR DestinationHostname matches "*dpaste*" OR DestinationHostname matches "*sprunge*" OR DestinationHostname matches "*termbin*" OR DestinationHostname matches "*ix.io*")
| timeslice 15m
| stats count as UploadCount, values(DestinationHostname) as Destinations by ComputerName, User, _timeslice
| where UploadCount >= 3
| sort by UploadCount desc

rule chunked_paste_dead_drop_exfiltration {
  meta:
    author = "df00tech"
    description = "Detects bursts of small paste-site uploads from the same host/user, consistent with chunked exfiltration evading per-paste size caps"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1567.003"
    threat_actors = "data-extortion and ransomware affiliates, espionage actors"
    reference = "https://attack.mitre.org/techniques/T1567/003/"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    re.regex($e.target.hostname, `(?i)(pastebin\.com|hastebin\.com|ghostbin|paste\.ee|dpaste|sprunge\.us|ix\.io|termbin|controlc\.com|rentry\.co)`)
    $hostname = $e.principal.hostname
    $user = $e.principal.user.userid

  match:
    $hostname, $user over 15m

  condition:
    #e >= 3
}

#event_simpleName=NetworkConnectIP4
| DomainName=/(?i)(pastebin\.com|hastebin|ghostbin|paste\.ee|dpaste|sprunge|termbin|controlc|rentry)/
| bucket(span=15m)
| groupBy([ComputerName, UserName, _bucket], function=[count(as=UploadCount), collect(DomainName, limit=10)])
| test(UploadCount >= 3)
| sort(field=UploadCount, order=desc)