Crowdstrike Reverse Shell Tool Executed

Description

Detects usage of tools commonly used to to establish reverse shells on Windows machines.

Query · python

from panther_crowdstrike_fdr_helpers import crowdstrike_detection_alert_context

REMOTE_SHELL_TOOLS = {
    #   process name: reverse shell signature
    "nc.exe": ["cmd.exe", "powershell.exe", "command.exe"],
    "ncat.exe": ["cmd.exe", "powershell.exe", "command.exe"],
    "socat.exe": ["cmd.exe", "powershell.exe", "command.exe"],
    "psexec.exe": ["cmd.exe", "powershell.exe", "command.exe"],
    "python.exe": ["cmd.exe", "powershell.exe", "command.exe"],
    "powershell.exe": ["System.Net.Sockets.TcpClient"],
    "certutil.exe": ["-urlcache"],
    "php.exe": ["fsockopen", "cmd.exe", "powershell.exe", "command.exe"],
}


def rule(event):
    if event.get("fdr_event_type", "") == "ProcessRollup2":
        if event.get("event_platform", "") == "Win":
            process_name = (
                event.deep_get("event", "ImageFileName", default="").lower().split("\\")[-1]
            )
            command_line = event.deep_get("event", "CommandLine", default="")
            signatures = REMOTE_SHELL_TOOLS.get(process_name, [])
            for signature in signatures:
                if signature in command_line:
                    return True
    return False


def title(event):
    tool = (
        event.deep_get("event", "ImageFileName", default="<TOOL_NOT_FOUND>").lower().split("\\")[-1]
    )
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    return f"Crowdstrike: Reverse shell tool [{tool}] detected on host [{host}]"


def alert_context(event):
    return crowdstrike_detection_alert_context(event)

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2023-05-04
Modified: 2024-04-02
Authored by: panther-labs
Source ID
Upstream: rules/crowdstrike_rules/crowdstrike_reverse_shell_tool_executed.yml
Type: rule
Version: 1
References: https://attack.mitre.org/techniques/T1059/
Data sources: Crowdstrike.FDREvent

ATT&CK

T1059

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.