
title: LOLBAS Data Exfiltration by DataSvcUtil.exe
author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger
date: 2021/09/30
description: Detects when a user performs data exfiltration by using DataSvcUtil.exe
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine: '*/in:*'
  SELECTION_3:
    CommandLine: '*/out:*'
  SELECTION_4:
    Image:
    - '*\DataSvcUtil.exe'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- DataSvcUtil.exe being used may be performed by a system administrator.
- Verify whether the user identity, user agent, and/or hostname should be making changes
  in your environment.
- DataSvcUtil.exe being executed from unfamiliar users should be investigated. If
  known behavior is causing false positives, it can be exempted from the rule.
- Penetration Testing
fields:
- ComputerName
- User
- CommandLine
- ParentCommandLine
id: e290b10b-1023-4452-a4a9-eb31a9013b3a
level: medium
logsource:
  category: process_creation
  product: windows
references:
- https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6
- https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
- https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services
- https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services
status: experimental
tags:
- attack.exfiltration
- attack.t1567
ruletype: SIGMA
