Proc creation lnx exfiltration data via sftp protocol (winscp tool)

[CheraghiMilad]

Summary of the Pull Request

The attacker may use the WinScp tool to exfiltrate data from the victim's system. This rule helps to identify data being exfiltrated through the SFTP protocol. (When using the WinScp tool, the SFTP protocol is used in the background to transfer data.)

Changelog

Log:
Nov 26 08:08:18 caldera-virtual-machine sysmon: 23542300x8000000000000000252928Linux-Sysmon/Operationalcaldera-virtual-machine-2024-11-24 19:52:14.888{36fe7a82-83c8-6743-d526-2fa8d7550000}6468caldera/usr/lib/openssh/sftp-server/home/caldera/rufus-4.6.exe.filepart---

host = caldera-virtual-machine
source = Syslog:Linux-Sysmon/Operational
sourcetype = sysmon_linux

---

Nov 26 08:08:16 caldera-virtual-machine sysmon: 23542300x8000000000000000252925Linux-Sysmon/Operationalcaldera-virtual-machine-2024-11-24 19:52:12.500{36fe7a82-83c8-6743-d526-2fa8d7550000}6468caldera/usr/lib/openssh/sftp-server/home/caldera/IMG_20241120_131011.jpg.filepart---

host = caldera-virtual-machine
source = Syslog:Linux-Sysmon/Operational
sourcetype = sysmon_linux

Pic:

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

HI,
Thanks.
The Eventid 23 is for FileDelete.
I find "WinSCP has a setting enabled by default that transfers files larger than 100kb to a temporary file name (with the .filepart extension) and then renames the file."
So the events are not exfiltration.

[CheraghiMilad]

HI, Thanks. The Eventid 23 is for FileDelete. I find "WinSCP has a setting enabled by default that transfers files larger than 100kb to a temporary file name (with the .filepart extension) and then renames the file." So the events are not exfiltration.

Hi, Thanks for the reply.
These files were exfiltrated during adversary emulation. If the .filepart keyword is commonly used in WinSCP, we can opt for a more relevant keyword that corresponds to files on the endpoint and remove the DeleteId from the rule.