Sigma rule: LOLBAS Data Exfiltration by DataSvcUtil.exe

Rule

Title

LOLBAS Data Exfiltration by DataSvcUtil.exe

Status

test

Level

medium

Author

Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger

Date

2021-09-30

Modified

2022-05-16

File

rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a user performs data exfiltration by using DataSvcUtil.exe

Log source

product

windows

category

process_creation

Detection

selection_cli:
    CommandLine|contains:
        - '/in:'
        - '/out:'
        - '/uri:'
selection_img:
    - Image|endswith: '\DataSvcUtil.exe'
    - OriginalFileName: 'DataSvcUtil.exe'
condition: all of selection*

False positives (as the rule lists them)

• DataSvcUtil.exe being used may be performed by a system administrator.
• Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
• DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.exfiltration
• attack.t1567

MITRE ATT&CK ids this rule names

• T1567

References

• https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6
• https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
• https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services
• https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services
• https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml