Data Exfiltration Over Encrypted Non-C2 Protocol (SFTP/FTPS/rsync-over-SSH)

let TimeWindow = 24h;
let MinBytesSent = 50000000;         // 50MB threshold for a single session
let TransferProcessNames = dynamic(["scp.exe", "sftp.exe", "winscp.exe", "psftp.exe", "rsync.exe", "rsync", "scp", "sftp"]);
let KnownCorpDestinations = dynamic(["<YOUR_CORP_SFTP_HOST>", "<YOUR_BACKUP_HOST>"]);
DeviceProcessEvents
| where Timestamp > ago(TimeWindow)
| where FileName in~ (TransferProcessNames)
| project ProcTimestamp = Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(TimeWindow)
    | where ActionType =~ "ConnectionSuccess"
    | where RemotePort in (22, 990, 989, 21, 2222)
    | where RemoteIPType == "Public"
    | project NetTimestamp = Timestamp, DeviceName, AccountName, RemoteIP, RemoteUrl, RemotePort, SentBytes, InitiatingProcessFileName
  ) on DeviceName, AccountName
| where InitiatingProcessFileName1 in~ (TransferProcessNames) or InitiatingProcessFileName in~ (TransferProcessNames)
| where datetime_diff('minute', NetTimestamp, ProcTimestamp) between (-5 .. 30)
| where RemoteUrl !in~ (KnownCorpDestinations) and RemoteIP !in~ (KnownCorpDestinations)
| summarize
    SessionCount = count(),
    TotalBytesSent = sum(SentBytes),
    Commands = make_set(ProcessCommandLine, 10),
    FirstSeen = min(ProcTimestamp),
    LastSeen = max(NetTimestamp)
  by DeviceName, AccountName, FileName, RemoteIP, RemotePort
| where TotalBytesSent > MinBytesSent or SessionCount > 3
| extend ThreatType = "Exfil_EncryptedProtocolTransfer"
| extend RiskScore = iff(TotalBytesSent > (MinBytesSent * 2), 85, 65)
| sort by RiskScore desc, TotalBytesSent desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image IN ("*\\scp.exe", "*\\sftp.exe", "*\\winscp.exe", "*\\psftp.exe", "*\\rsync.exe")
| rename Image AS TransferImage, CommandLine AS TransferCommandLine, _time AS ProcTime
| join type=inner host, User
  [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
    DestinationPort IN (22,21,989,990,2222)
    | eval NetTime=_time
    | table host, User, DestinationIp, DestinationPort, DestinationHostname, NetTime ]
| eval TimeDeltaMin=abs((NetTime - ProcTime)/60)
| where TimeDeltaMin <= 30
| lookup corp_sftp_allowlist DestinationHostname OUTPUT is_corp
| where isnull(is_corp)
| stats count AS SessionCount, values(TransferCommandLine) AS Commands, earliest(ProcTime) AS FirstSeen, latest(NetTime) AS LastSeen
  BY host, User, TransferImage, DestinationHostname, DestinationPort
| where SessionCount > 3
| eval ThreatType="Exfil_EncryptedProtocolTransfer"
| eval RiskScore=if(SessionCount > 10, 85, 65)
| sort - RiskScore, - SessionCount

network where event.type == "start" and
  destination.port in (22, 21, 989, 990, 2222) and
  process.name : ("scp.exe", "sftp.exe", "winscp.exe", "psftp.exe", "rsync.exe", "rsync", "scp", "sftp") and
  not destination.ip : ("<YOUR_CORP_SFTP_RANGE>")

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "Process Name" AS ProcessName,
    destinationip AS DestinationIp,
    destinationport AS DestinationPort,
    SUM(bytessent) AS TotalBytesSent
FROM events
WHERE
    destinationport IN (22, 21, 989, 990, 2222)
    AND LOWER("Process Name") IN ('scp.exe', 'sftp.exe', 'winscp.exe', 'psftp.exe', 'rsync.exe', 'rsync', 'scp', 'sftp')
    AND starttime > NOW() - 86400000
GROUP BY hostname, username, "Process Name", destinationip, destinationport
HAVING SUM(bytessent) > 50000000
ORDER BY TotalBytesSent DESC
LIMIT 500

_sourceCategory=*sysmon* OR _sourceCategory=*netflow*
| where DestinationPort in (22, 21, 989, 990, 2222)
| where (Image matches "*scp.exe" or Image matches "*sftp.exe" or Image matches "*winscp.exe" or Image matches "*rsync*")
| stats count as SessionCount, sum(SentBytes) as TotalBytesSent by ComputerName, User, Image, DestinationIp, DestinationPort
| where TotalBytesSent > 50000000 or SessionCount > 3
| sort - TotalBytesSent

rule encrypted_protocol_data_exfiltration {
  meta:
    author = "df00tech"
    description = "Detects bulk data exfiltration over encrypted non-C2 protocols (SFTP/FTPS/rsync-over-SSH)"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.001"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.target.port = 22 or $e.target.port = 21 or $e.target.port = 989 or $e.target.port = 990 or $e.target.port = 2222
    re.regex($e.principal.process.file.full_path, `(?i)(scp|sftp|winscp|psftp|rsync)(\.exe)?$`)

  condition:
    $e
}

#event_simpleName=NetworkConnectIP4
| RemotePort=/^(22|21|989|990|2222)$/
| ImageFileName=/(?i)(scp|sftp|winscp|psftp|rsync)(\.exe)?$/
| groupBy([ComputerName, UserName, ImageFileName, RemoteAddressIP4, RemotePort], function=[count(as=SessionCount), sum(field=BytesSent, as=TotalBytesSent)])
| test(TotalBytesSent > 50000000 || SessionCount > 3)