SigmaHQ/rules/windows/process_creation/win_crime_fireball.yml

title: Fireball Archer Install
id: 3d4aebe0-6d29-45b2-a8a4-3dfde586a26d
status: experimental
description: Detects Archer malware invocation via rundll32
author: Florian Roth
date: 2017/06/03
modified: 2020/08/29
references:
    - https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/
    - https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100
tags:
    - attack.execution
    - attack.defense_evasion
    - attack.t1218.011
    - attack.t1085  # an old one
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine: '*\rundll32.exe *,InstallArcherSvc'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Unknown
level: high
Massive Title Cleanup 2018-01-27 09:57:30 +00:00			`title: Fireball Archer Install`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 3d4aebe0-6d29-45b2-a8a4-3dfde586a26d`
Fireball Sigma Rule 2017-06-03 12:48:47 +00:00			`status: experimental`
Fixed description and title 2017-06-03 12:53:08 +00:00			`description: Detects Archer malware invocation via rundll32`
Fireball Sigma Rule 2017-06-03 12:48:47 +00:00			`author: Florian Roth`
			`date: 2017/06/03`
att&ck tags review: windows/process_creation part 2 2020-08-29 04:39:30 +00:00			`modified: 2020/08/29`
Change All "str" references to be "list"to mach schema update 2018-01-27 23:24:16 +00:00			`references:`
Fireball Sigma Rule 2017-06-03 12:48:47 +00:00			`- https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/`
			`- https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100`
add tags to crime fireball rule 2019-03-13 10:10:12 +00:00			`tags:`
			`- attack.execution`
fixed tag typo on rules 2019-03-13 10:22:38 +00:00			`- attack.defense_evasion`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1218.011`
att&ck tags review: windows/process_creation part 2 2020-08-29 04:39:30 +00:00			`- attack.t1085 # an old one`
Fireball Sigma Rule 2017-06-03 12:48:47 +00:00			`logsource:`
Converted to use the new process_creation data source 2019-03-09 17:57:59 +00:00			`category: process_creation`
Fireball Sigma Rule 2017-06-03 12:48:47 +00:00			`product: windows`
			`detection:`
			`selection:`
			`CommandLine: '\rundll32.exe ,InstallArcherSvc'`
Fixed description and title 2017-06-03 12:53:08 +00:00			`condition: selection`
Added field names to first rules 2017-09-12 21:54:04 +00:00			`fields:`
			`- CommandLine`
			`- ParentCommandLine`
Fireball Sigma Rule 2017-06-03 12:48:47 +00:00			`falsepositives:`
			`- Unknown`
			`level: high`