{"id":"7d1aaf3d-4304-425c-b7c3-162055e0b3ab","title":"Potential Data Exfiltration Activity Via CommandLine Tools","description":"Detects the use of various CLI utilities exfiltrating data via web requests","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-02","modified":"2025-10-19","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_data_exfiltration_via_cli.yml","source_sha256":"6c4a702aae5999d77de4136e4aa8ea30cd312e4af65fb768f9b62042ddc23be0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_data_exfiltration_via_cli.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Data Exfiltration Activity Via CommandLine Tools\nid: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab\nstatus: test\ndescription: Detects the use of various CLI utilities exfiltrating data via web requests\nreferences:\n    - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-02\nmodified: 2025-10-19\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_iwr:\n        Image|endswith:\n            - '\\powershell_ise.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\cmd.exe'\n        CommandLine|contains:\n            - 'curl '\n            - 'Invoke-RestMethod'\n            - 'Invoke-WebRequest'\n            - 'irm '\n            - 'iwr '\n            - 'wget '\n        CommandLine|contains|all:\n            - ' -ur' # Shortest possible version of the -uri flag\n            - ' -me' # Shortest possible version of the -method flag\n            - ' -b'\n            - ' POST '\n    selection_curl:\n        Image|endswith: '\\curl.exe'\n        CommandLine|contains: '--ur' # Shortest possible version of the --uri flag\n    selection_curl_data:\n        CommandLine|contains:\n            - ' -d ' # Shortest possible version of the --data flag\n            - ' --data '\n    selection_wget:\n        Image|endswith: '\\wget.exe'\n        CommandLine|contains:\n            - '--post-data'\n            - '--post-file'\n    payloads:\n        - CommandLine|re:\n              - 'net\\s+view'\n              - 'sc\\s+query'\n        - CommandLine|contains:\n              - 'Get-Content'\n              - 'GetBytes'\n              - 'hostname'\n              - 'ifconfig'\n              - 'ipconfig'\n              - 'netstat'\n              - 'nltest'\n              - 'qprocess'\n              - 'systeminfo'\n              - 'tasklist'\n              - 'ToBase64String'\n              - 'whoami'\n        - CommandLine|contains|all:\n              - 'type '\n              - ' > '\n              - ' C:\\'\n    condition: (selection_iwr or all of selection_curl* or selection_wget) and payloads\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/7d1aaf3d-4304-425c-b7c3-162055e0b3ab.json","kind":"sigma"}