LOLBAS Data Exfiltration by DataSvcUtil.exe

Title: LOLBAS Data Exfiltration by DataSvcUtil.exe
Status: test
Description:Detects when a user performs data exfiltration by using DataSvcUtil.exe
References:
  -https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6
  -https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
  -https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services
  -https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services
  -https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/
Author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger
Date: 2021-09-30
modified:2022-05-16
Tags:

• -'attack.exfiltration'
• -'attack.t1567'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_cli:
    CommandLine|contains:
      -'/in:'
      -'/out:'
      -'/uri:'

  selection_img:
Image|endswith:'\DataSvcUtil.exe' OriginalFileName:'DataSvcUtil.exe'   condition:all of selection*
Falsepositives:
  -DataSvcUtil.exe being used may be performed by a system administrator.
  -Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  -DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
Level: medium