SigmaHQ/rules/windows/process_creation/win_malware_dridex.yml

title: Dridex Process Pattern
id: e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e
status: experimental
description: Detects typical Dridex process patterns
references:
    - https://app.any.run/tasks/993daa5e-112a-4ff6-8b5a-edbcec7c7ba3
author: Florian Roth
date: 2019/01/10
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine: '*\svchost.exe C:\Users\\*\Desktop\\*'
    selection2:
        ParentImage: '*\svchost.exe*'
        CommandLine:
            - '*whoami.exe /all'
            - '*net.exe view'
    condition: 1 of them
falsepositives:
    - Unlikely
level: critical
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`title: Dridex Process Pattern`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`status: experimental`
			`description: Detects typical Dridex process patterns`
			`references:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`- https://app.any.run/tasks/993daa5e-112a-4ff6-8b5a-edbcec7c7ba3`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`author: Florian Roth`
			`date: 2019/01/10`
Missing tags 2019-03-05 23:16:40 +00:00			`tags:`
			`- attack.defense_evasion`
			`- attack.privilege_escalation`
			`- attack.t1055`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`logsource:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`category: process_creation`
			`product: windows`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`detection:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`selection1:`
			`CommandLine: '\svchost.exe C:\Users\\\Desktop\\*'`
			`selection2:`
			`ParentImage: '\svchost.exe'`
			`CommandLine:`
			`- '*whoami.exe /all'`
			`- '*net.exe view'`
			`condition: 1 of them`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`falsepositives:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`- Unlikely`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`level: critical`