reverse-shell-nishang

Description

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links: 1. CVE-2021-26855 2. CVE-2021-26857 3. CVE-2021-26858 4. CVE-2021-27065 The following query finds evidence of a reverse shell being loaded using a technique associated with the Nishang penetration testing framework. This might indicate an attacker has remote access to the device. More queries related to this threat can be found under the See also section of this page. Reference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/

Query · kql

DeviceProcessEvents | where FileName has_any ("cmd.exe", "powershell.exe", "PowerShell_ISE.exe") 
| where ProcessCommandLine contains "$client = New-Object System.Net.Sockets.TCPClient"
Raw source reverse-shell-nishang · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 7490e437-edc2-40b3-87fe-45b736593deb
name: reverse-shell-nishang
description: |
  This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild".
  In early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:
  1. CVE-2021-26855
  2. CVE-2021-26857
  3. CVE-2021-26858
  4. CVE-2021-27065
  The following query finds evidence of a reverse shell being loaded using a technique associated with the Nishang penetration testing framework. This might indicate an attacker has remote access to the device.
  More queries related to this threat can be found under the See also section of this page.
  Reference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Persistence
- Exfiltration
query: |
  DeviceProcessEvents | where FileName has_any ("cmd.exe", "powershell.exe", "PowerShell_ISE.exe") 
  | where ProcessCommandLine contains "$client = New-Object System.Net.Sockets.TCPClient"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.