Data Exfiltration to Public Paste and Text-Storage Sites

let LookbackWindow = 24h;
let PasteSiteDomains = dynamic([
  "pastebin.com", "paste.ee", "ghostbin.com", "rentry.co", "hastebin.com",
  "dpaste.org", "dpaste.com", "controlc.com", "0bin.net", "paste2.org",
  "pastelink.net", "justpaste.it", "privatebin.net"
]);
let KnownBrowsers = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "iexplore.exe"]);
DeviceNetworkEvents
| where Timestamp > ago(LookbackWindow)
| where ActionType == "ConnectionSuccess"
| where isnotempty(RemoteUrl)
| where RemoteUrl has_any (PasteSiteDomains)
| where InitiatingProcessFileName !in~ (KnownBrowsers)
| summarize
    ConnectionCount = count(),
    Domains = make_set(RemoteUrl, 5),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| project FirstSeen, LastSeen, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessFolderPath, InitiatingProcessCommandLine, ConnectionCount, Domains
| sort by LastSeen desc

index=proxy OR index=web
(url="*pastebin.com*" OR url="*paste.ee*" OR url="*ghostbin.com*" OR url="*rentry.co*" OR url="*hastebin.com*" OR url="*dpaste.org*" OR url="*dpaste.com*" OR url="*controlc.com*" OR url="*0bin.net*" OR url="*paste2.org*" OR url="*pastelink.net*" OR url="*justpaste.it*" OR url="*privatebin.net*")
NOT process_name IN ("chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe","iexplore.exe")
| stats
    count as ConnectionCount,
    values(url) as Domains,
    earliest(_time) as FirstSeen,
    latest(_time) as LastSeen
    by src_ip, user, process_name, process_path, CommandLine
| eval FirstSeen=strftime(FirstSeen, "%Y-%m-%d %H:%M:%S")
| eval LastSeen=strftime(LastSeen, "%Y-%m-%d %H:%M:%S")
| table FirstSeen, LastSeen, src_ip, user, process_name, process_path, CommandLine, ConnectionCount, Domains
| sort - ConnectionCount

network where event.category == "network" and network.protocol == "http" and url.domain in ("pastebin.com", "paste.ee", "ghostbin.com", "rentry.co", "hastebin.com", "dpaste.org", "dpaste.com", "controlc.com", "0bin.net", "paste2.org", "pastelink.net", "justpaste.it", "privatebin.net") and not process.name in ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")

SELECT
    sourceip AS SourceIP,
    "URL" AS RequestUrl,
    "Application Name" AS ProcessName,
    COUNT(*) AS ConnectionCount,
    MIN(starttime) AS FirstSeen,
    MAX(starttime) AS LastSeen
FROM events
WHERE
    ("URL" ILIKE '%pastebin.com%' OR "URL" ILIKE '%paste.ee%' OR "URL" ILIKE '%ghostbin.com%' OR "URL" ILIKE '%rentry.co%' OR "URL" ILIKE '%hastebin.com%' OR "URL" ILIKE '%dpaste.org%')
    AND "Application Name" NOT IN ('chrome.exe', 'msedge.exe', 'firefox.exe', 'brave.exe', 'opera.exe')
    AND starttime > (NOW() - 86400000)
GROUP BY sourceip, "URL", "Application Name"
ORDER BY ConnectionCount DESC

_sourceCategory=network/proxy
| parse "src_ip=*," as src_ip nodrop
| parse "url=*," as url nodrop
| parse "process_name=*," as process_name nodrop
| where url matches "*pastebin.com*" or url matches "*paste.ee*" or url matches "*ghostbin.com*" or url matches "*rentry.co*" or url matches "*hastebin.com*"
| where !(process_name in ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe"))
| count as ConnectionCount, values(url) as Domains by src_ip, process_name
| sort by ConnectionCount desc

rule paste_site_non_browser_exfiltration {
  meta:
    author = "Detection Engineering"
    description = "Detects a non-browser process establishing an outbound HTTP(S) connection to a known paste/text-storage site, consistent with infostealer or leak-actor data exfiltration."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1567.003"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /pastebin\.com|paste\.ee|ghostbin\.com|rentry\.co|hastebin\.com|dpaste\.(org|com)/ nocase
    $e.principal.process.file.full_path != /chrome\.exe|msedge\.exe|firefox\.exe|brave\.exe|opera\.exe/ nocase
    $proc = $e.principal.process.file.full_path
    $url = $e.target.url

  match:
    $proc, $url over 1h

  outcome:
    $connection_count = count($e.metadata.id)

  condition:
    $e and $connection_count >= 1
}

#event_simpleName=DnsRequest
| in(field=DomainName, values=["pastebin.com", "paste.ee", "ghostbin.com", "rentry.co", "hastebin.com", "dpaste.org", "dpaste.com"], ignoreCase=true)
| !in(field=ImageFileName, values=["*\\chrome.exe", "*\\msedge.exe", "*\\firefox.exe", "*\\brave.exe", "*\\opera.exe"], ignoreCase=true)
| groupBy([ComputerName, ImageFileName, DomainName], function=count(as=ConnectionCount))
| sort(field=ConnectionCount, order=desc)