Exfiltration Over Other Network Medium — Data Exfiltration via USB Cellular Modem / Mobile Hotspot Tethering (Corporate Network Bypass)

let LookbackWindow = 24h;
let RndisClassGuid = "{4d36e972-e325-11ce-bfc1-08002be10318}";
let TetherIndicators = dynamic([
  "usbrndis6.inf", "wceusbsh.inf", "RNDIS", "Android Bootloader Interface",
  "Apple Mobile Device", "iPhone", "Personal Hotspot", "Remote NDIS"
]);
let RndisRegistryEvents =
  DeviceRegistryEvents
  | where Timestamp > ago(LookbackWindow)
  | where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
  | where RegistryKey has RndisClassGuid
      or RegistryValueData has_any (TetherIndicators)
      or RegistryKey has_any ("Enum\\USB", "Enum\\USBSTOR")
  | where RegistryValueData has_any (TetherIndicators) or RegistryKey has RndisClassGuid
  | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
      RegistryKey, RegistryValueName, RegistryValueData,
      InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType = "RNDIS Tethering Device Installed";
let TetheredSubnetTraffic =
  DeviceNetworkEvents
  | where Timestamp > ago(LookbackWindow)
  | where ipv4_is_in_range(LocalIP, "192.168.42.0/24") or ipv4_is_in_range(LocalIP, "192.168.43.0/24") or ipv4_is_in_range(LocalIP, "172.20.10.0/28")
  | project Timestamp, DeviceName, AccountName, LocalIP, RemoteIP, RemoteUrl,
      InitiatingProcessFileName, InitiatingProcessCommandLine,
      RegistryKey = "", RegistryValueName = "", RegistryValueData = "", DetectionType = "Traffic Over Known Tethered-Subnet IP";
RndisRegistryEvents
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType
| union (TetheredSubnetTraffic | project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType)
| sort by Timestamp desc

| union
  [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13)
   (TargetObject="*{4d36e972-e325-11ce-bfc1-08002be10318}*"
    OR Details="*RNDIS*" OR Details="*Apple Mobile Device*" OR Details="*Android Bootloader Interface*"
    OR Details="*usbrndis6.inf*" OR Details="*Remote NDIS*")
  | eval DetectionType="RNDIS Tethering Device Installed"
  | table _time, host, User, TargetObject, Details, Image, DetectionType]
[search index=sysmon OR index=edr EventCode=3
  | eval TetheredSubnetMatch=if(cidrmatch("192.168.42.0/24",SourceIp) OR cidrmatch("192.168.43.0/24",SourceIp) OR cidrmatch("172.20.10.0/28",SourceIp) OR cidrmatch("192.168.42.0/24",DestinationIp) OR cidrmatch("192.168.43.0/24",DestinationIp) OR cidrmatch("172.20.10.0/28",DestinationIp), 1, 0)
  | where TetheredSubnetMatch=1
  | eval DetectionType="Traffic Over Known Tethered-Subnet IP"
  | table _time, host, User, SourceIp, DestinationIp, Image, DetectionType]
| sort - _time

registry where event.action == "modification" and (registry.path : "*{4d36e972-e325-11ce-bfc1-08002be10318}*" or registry.data.strings : ("*RNDIS*", "*Apple Mobile Device*", "*Android Bootloader Interface*", "*usbrndis6.inf*"))

SELECT
    "Registry Key" AS RegistryKey,
    "Registry Value Data" AS RegistryValueData,
    "Username" AS Username,
    devicetime AS EventTime
FROM events
WHERE
    ("Registry Key" ILIKE '%{4d36e972-e325-11ce-bfc1-08002be10318}%'
     OR "Registry Value Data" ILIKE '%RNDIS%'
     OR "Registry Value Data" ILIKE '%Apple Mobile Device%'
     OR "Registry Value Data" ILIKE '%Android Bootloader Interface%'
     OR "Registry Value Data" ILIKE '%usbrndis6.inf%')
    AND devicetime > (NOW() - 86400000)
ORDER BY devicetime DESC

_sourceCategory=endpoint/registry
| parse "host=*," as host nodrop
| parse "RegistryKey=*," as registry_key nodrop
| parse "RegistryValueData=*," as registry_value_data nodrop
| where registry_key matches "*{4d36e972-e325-11ce-bfc1-08002be10318}*" or registry_value_data matches "*RNDIS*" or registry_value_data matches "*Android Bootloader Interface*" or registry_value_data matches "*usbrndis6.inf*"
| count as EventCount by host, registry_key, registry_value_data
| sort by EventCount desc

rule usb_rndis_tethering_exfil_bypass {
  meta:
    author = "Detection Engineering"
    description = "Detects installation of a USB RNDIS tethering network adapter (Android/iPhone hotspot), a corporate network-monitoring bypass channel for T1011 exfiltration."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1011"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "REGISTRY_MODIFICATION"
    $e.target.registry.registry_value_data = /RNDIS|Apple Mobile Device|Android Bootloader Interface|usbrndis6\.inf/ nocase
    $host = $e.principal.hostname
    $data = $e.target.registry.registry_value_data

  match:
    $host over 1h

  outcome:
    $event_count = count($e.metadata.id)

  condition:
    $e and $event_count >= 1
}

#event_simpleName=RegSetValue
| regex(field=RegistryValueName, regex="(?i)(RNDIS|Apple Mobile Device|Android Bootloader Interface|usbrndis6\.inf)")
or regex(field=RegistryKey, regex="4d36e972-e325-11ce-bfc1-08002be10318")
| groupBy([ComputerName, RegistryKey, RegistryValueName], function=count(as=EventCount))
| sort(field=EventCount, order=desc)