Windows.EventLogs.MoveIt

name:  Windows.EventLogs.MoveIt
author: Rapid7 team -  Ted Samuels, @mgreen27 & @scudette
description: |
  This Artifact enables scoping EventLogs from Progress Software's MoveIT File
  Transfer. It is designed to assist in identifying exfiltration resulting from
  the exploitation of CVE-2023-34362

  This artifact parses EvtxHunter output and returns a set of fields in results.
  An unparsed data field is available in the hidden `_RawData` field.

  There are several parameter's available for search leveraging regex.

    - EvtxGlob glob of EventLogs to target. Default to MoveIt.evtx but can be targeted.
    - dateAfter enables search for events after this date.
    - dateBefore enables search for events before this date.
    - IocRegex enables regex search over the message field.
    - IgnoreRegex enables a regex whitelist for the Message field.
    - IdRegex enables a regex query to select specific event Ids.
    - VSSAnalysisAge enables searching over VSS.

  NOTE: MoveIT event logging may not be turned on by default.

reference:
    - https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/
    - https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-respons
    - https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34362

precondition: SELECT OS From info() where OS = 'windows'

parameters:
  - name: EvtxGlob
    default: '%SystemRoot%\System32\Winevt\Logs\MOVEit.evtx'
  - name: IocRegex
    type: regex
    description: "IOC Regex"
    default:
  - name: IgnoreRegex
    description: "Regex of string to whitelist"
    type: regex
  - name: IdRegex
    default: .
    type: regex
  - name: VSSAnalysisAge
    type: int
    default: 0
    description: |
       If larger than zero we analyze VSS within this many days
       ago. (e.g 7 will analyze all VSS within the last week).  Note
       that when using VSS analysis we have to use the ntfs accessor
       for everything which will be much slower.
  - name: DateAfter
    type: timestamp
    description: "search for events after this date. YYYY-MM-DDTmm:hh:ssZ"
  - name: DateBefore
    type: timestamp
    description: "search for events before this date. YYYY-MM-DDTmm:hh:ssZ"

sources:
  - query: |
      LET Parse(X) = to_dict(
        item={
           SELECT split(sep=":", string=Column0)[0] AS _key,
                  regex_replace(re="^\\s+|\\s+$", replace="", source=split(sep=":", string=Column0)[1]) AS _value
           FROM split_records(accessor="data", filenames=X, regex="\r\n")
           WHERE Column0 =~ "^[a-zA-Z0-9]+:"
        }) +  parse_string_with_regex(regex="User '(?P<User>[^']+)'", string=X)

      SELECT EventTime,Computer,Channel,Provider,EventID,EventRecordID,
        Parse(X=split(string=EventData.Data[0],sep="\r\n\r\n")[1]) as EventData,
        split(string=EventData.Data[0],sep="\r\n\r\n")[0] as Message,
        FullPath,
        EventData.Data[0] as _RawData
      FROM Artifact.Windows.EventLogs.EvtxHunter(
                        EvtxGlob=EvtxGlob,
                        IocRegex=IocRegex,
                        IdRegex=IdRegex,
                        WhitelistRegex=IgnoreRegex,
                        DateAfter=DateAfter,
                        DateBefore=DateBefore,
                        VSSAnalysisAge=VSSAnalysisAge )