Name:Windows Process Outbound Connection To Social Media Domain id:d6dc231e-8595-499b-889e-cf6a055df4d4 version:1 date:None author:Teoderick Contreras, Splunk status:production type:Anomaly Description:This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains.
It leverages Sysmon Event ID 3 to surface this anomalous behavior.
Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure. Data_source:
process_name IN ( "py.exe", "pypy.exe", "python.exe", "python2*.exe", "python3*.exe", "pythonw.exe" )
dest IN ( "*.facebook.com", "*.facebook.net", "*.facebook.org", "*.fb.com", "*.fbcd.net", "*.fbsbx.com", "*.fbstatic-a.akamaihd.net", "*.tfbw.net" ) direction = outbound
| rename Image as process_path
| stats count min(_time) as firstTime max(_time) as lastTime
by action app dest dest_ip dest_port direction dvc protocol protocol_version process_path process_name process_guid process_id src src_ip src_port transport user vendor_product
how_to_implement:To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives:No false positives have been identified at this time. References: -https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html drilldown_searches: name:'View the detection results for - "$src$"' search:'%original_detection_search% | search src = "$src$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$src$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Braodo Stealer']
