Windows: Detect Data Exfiltration via DataSvcUtil.exe with /in /out /uri arguments

Alerts on DataSvcUtil.exe runs with /in:, /out:, and /uri: parameters that may indicate data exfiltration activity.

FreeUnreviewedSigmamediumv1

windows-detect-data-exfiltration-via-datasvcutil-exe-with-in-out-uri-arguments-e290b10b

title: "Windows: Detect Data Exfiltration via DataSvcUtil.exe with /in /out /uri arguments"
id: 29bef1af-7768-452b-a9c6-2811d52a6607
status: test
description: "This rule flags process executions of DataSvcUtil.exe where the command line contains the /in:, /out:, and /uri: parameters. Attackers can abuse this utility to collect or transform data and write it to an output location while communicating with a specified service URI. It relies on Windows process creation telemetry, specifically the executed image path, OriginalFileName, and the full command-line arguments."
references:
  - https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services
  - https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml
author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger, Huntrule Team
date: 2021-09-30
modified: 2022-05-16
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection_cli:
    CommandLine|contains:
      - "/in:"
      - "/out:"
      - "/uri:"
  selection_img:
    - Image|endswith: \DataSvcUtil.exe
    - OriginalFileName: DataSvcUtil.exe
  condition: all of selection*
falsepositives:
  - DataSvcUtil.exe being used may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: e290b10b-1023-4452-a4a9-eb31a9013b3a
    type: derived

What it detects

This rule flags process executions of DataSvcUtil.exe where the command line contains the /in:, /out:, and /uri: parameters. Attackers can abuse this utility to collect or transform data and write it to an output location while communicating with a specified service URI. It relies on Windows process creation telemetry, specifically the executed image path, OriginalFileName, and the full command-line arguments.

Known false positives

DataSvcUtil.exe being used may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.