Skip to main content

Obfuscated Command-Line Detection Using Splunk Search

How to use SOC Prime Platform content for detection of obfuscated Windows command-line invocations on endpoints

Written by Andrew Vdovin

Overview

This guide describes how to use SOC Prime Platform content to solve a crucial security issue — the detection of obfuscated Windows command-line invocations on endpoints.

Highly skilled attackers use encoding techniques and memory-only payloads to conceal their commands from A/V and application whitelisting technologies. Such attacker techniques prevent Blue Teams from determining what was executed on a target system.

Windows command-line arguments are used in administration of operating systems through a CLI (command-line interface). This command-line interface provides access to many powerful system administration tools, such as PowerShell and WMIC. In an ideal scenario, access to CLI is restricted for malicious users, and the command-line inputs are logged for forensic investigation. However, cyber attackers are implementing sophisticated command-line obfuscation techniques to bypass these access restrictions and compromise system security. Common pattern matching techniques on obfuscated command-line arguments do not suit this purpose as detection mechanisms cannot work properly due to the large search space presented in obfuscated commands.

Command-Line Obfuscation: Double Quotes Technique

One of the basic techniques involves using double quotes (") in a command. Balanced double quotes that are inserted into a command-line argument do not affect the command execution; however, the command-line parser uses double quotation marks as an argument delimiter. Therefore, double quotes can be used maliciously for the concatenation of an argument.

Here's an example of using this technique by attackers to remain undetected.

Let's try to run an obfuscated command:

Here's how Sysmon logs this event:

Detecting Double Quotes in Command Lines Using the SOC Prime Platform Content for Splunk

Let's have a look how simple it is to use specific Splunk-based rules from the SOC Prime Platform to detect double quotes in command lines:

  1. Log in to the SOC Prime Platform.

  2. Go to Content > Advanced Search, type double quotes in the Search Bar, and press Enter.

  3. In the search results, click on the item Suspicious Double Quotes Sequence (via cmdline) to move to the content item page.

  4. Open the Code tab and select Splunk from the list of available platforms.

  5. Copy the query code and paste it manually into your Splunk instance or click the Search in Splunk button to drill down to the result of your detection.

    Note:

    Note that you will see Search in Splunk provided that your Splunk integration is configured.

  6. If you haven’t configured a Splunk integration environment, fill in all the required fields for your Splunk instance on the Hunt (Web Search) tab, and then click Save Changes.

  7. Now you’re all set to run the search query in your Splunk instance. Go back to step 5 to drill down to the detection result:

  8. Check out the results found by Splunk:

    In our example, two results were found indicating this type of command-line obfuscation.

Troubleshooting

If you have encountered any issues and need assistance, contact us in the live chat available on any page of the SOC Prime Platform:

  1. Click the chat icon in the lower right corner of the screen.

  2. Select the Messages tab and click Send us a message.

  3. Describe your issue or question mentioning the name of the content item they are related to.

Alternatively, for Sigma rules and their translations, you can also click the Report Issue icon on the Code tab of the rule page and describe your issue in the form that appears.

Did this answer your question?