Query: detect Detects when a user performs data exfiltration by using DataSvcUtil.exe in logs
Matching passage: Sigma rule: Detects when a user performs data exfiltration by using DataSvcUtil.exe. Logsource: windows / process_creation. Rule: title: LOLBAS Data Exfiltration by DataSvcUtil.exe id: e290b10b-1023-4452-a4a9-eb31a9013b3a status: test description: Detects when a user performs data exfiltration by using DataSvcUtil.exe references: - https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6 - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services - https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/ author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger date: 2021-09-30 modified: 2022-05-16 tags: - attack.exfiltration - attack.t1567 logsource: category: process_creation product: windows detection: selection_cli: CommandLine|contains: - '/in:' - '/out:' - '/uri:' selection_img: - Image|endswith: \DataSvcUtil.exe - OriginalFileName: DataSvcUtil.exe condition: all of selection* falsepositives: - DataSvcUtil.exe being used may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detect usage of the "ssh.exe" binary as a proxy to launch other programs.. Logsource: windows / process_creation. Rule: title: Program Executed Using Proxy/Local Command Via SSH.EXE id: 7d6d30b8-5b91-4b90-a891-46cccaf29598 status: test description: Detect usage of the "ssh.exe" binary as a proxy to launch other programs. references: - https://lolbas-project.github.io/lolbas/Binaries/Ssh/ - https://github.com/LOLBAS-Project/LOLBAS/pull/211/files - https://gtfobins.github.io/gtfobins/ssh/ - https://man.openbsd.org/ssh_config#ProxyCommand - https://man.openbsd.org/ssh_config#LocalCommand author: frack113, Nasreddine Bencherchali date: 2022-12-29 modified: 2025-10-16 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage: C:\Windows\System32\OpenSSH\sshd.exe selection_cli_img: - Image|endswith: \ssh.exe - Product: OpenSSH for Windows - Hashes|contains: - IMPHASH=55b4964d29aad5438b9e950052dbbbc0 - IMPHASH=334d66c33503ccbf647c15b47c27eef4 - IMPHASH=27b0da080ef92afb37983d30d839141e - IMPHASH=977eb4c263d384e47daa0712d34713ab - IMPHASH=3eaadce9ae43d5a918bb082065815c3b - IMPHASH=980fe6cf0d996ab1eedf877222e722aa - IMPHASH=5f959422308ac3d721010d66647e100e - IMPHASH=a49aaa3d03d1cd9c8dc7fca60f7f480b - IMPHASH=dd335f759b6d5d6a8382b71dd9d65791 selection_cli_flags: - CommandLine|contains: ProxyCommand= - CommandLine|contains|all: - PermitLocalCommand=yes - ' LocalCommand' condition: selection_parent or all of selection_cli_* falsepositives: - Legitimate usage for administration purposes level: medium