PUA - Netcat Suspicious Execution

Severity: high
Author: frack113, Florian Roth (Nextron Systems)
Source: upstream

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1095` Non-Application Layer Protocol

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `1 of selection_img`

or:
Image|endswith: '\nc.exe'
Image|endswith: '\ncat.exe'
Image|endswith: '\netcat.exe'

Stage 2: `1 of selection_cmdline`

or:
CommandLine|contains: ' --lua-exec '
CommandLine|contains: ' --sh-exec '
CommandLine|contains: ' -l --proxy-type http '
CommandLine|contains: ' -l -v -p '
CommandLine|contains: ' -lv -p '
CommandLine|contains: ' -lvnp'
CommandLine|contains: ' -lvp '
CommandLine|contains: ' -vnl --exec '
CommandLine|contains: ' -vnl -e '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`--lua-exec` `--sh-exec` `-l --proxy-type http` `-l -v -p` `-lv -p` `-lvnp` `-lvp` `-vnl --exec` `-vnl -e`
`Image`	ends_with	`\nc.exe` `\ncat.exe` `\netcat.exe`