SigmaHQ/rules/windows/malware/mal_azorult_reg.yml

title: Registry Entries For Azorult Malware
id: f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7
description: Detects the presence of a registry key created during Azorult execution
status: experimental
references:
  - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a
author: Trent Liffick
date: 2020/05/08
tags:
  - attack.execution
  - attack.t1112
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    EventID:
      - 12
      - 13
    TargetObject|contains: 'SYSTEM\'
    TargetObject|endswith: '\services\localNETService'
  condition: selection
fields:
  - Image
  - TargetObject
  - TargetDetails
falsepositives:
  - unknown
level: critical
fixed various spelling errors all over rules and source code 2021-02-24 14:43:13 +00:00			`title: Registry Entries For Azorult Malware`
Registry entry for Azorult malware Detects registry keys used by Azorult malware 2020-05-09 01:26:24 +00:00			`id: f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7`
			`description: Detects the presence of a registry key created during Azorult execution`
			`status: experimental`
			`references:`
			`- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a`
			`author: Trent Liffick`
			`date: 2020/05/08`
			`tags:`
			`- attack.execution`
			`- attack.t1112`
			`logsource:`
			`product: windows`
- Cleaned up some more rules where 'service: sysmon' was combined with category - Replaced 'service: sysmon' with category: ... for some more events to make the rules more product independent modified: rules/windows/builtin/win_invoke_obfuscation_obfuscated_iex_services.yml modified: rules/windows/malware/mal_azorult_reg.yml modified: rules/windows/powershell/powershell_suspicious_profile_create.yml modified: rules/windows/process_creation/sysmon_cmstp_execution.yml modified: rules/windows/process_creation/win_apt_chafer_mar18.yml modified: rules/windows/process_creation/win_apt_unidentified_nov_18.yml modified: rules/windows/process_creation/win_hktl_createminidump.yml modified: rules/windows/process_creation/win_mal_adwind.yml modified: rules/windows/process_creation/win_silenttrinity_stage_use.yml 2020-10-02 08:45:29 +00:00			`category: registry_event`
Registry entry for Azorult malware Detects registry keys used by Azorult malware 2020-05-09 01:26:24 +00:00			`detection:`
			`selection:`
			`EventID:`
			`- 12`
			`- 13`
Update mal_azorult_reg.yml 2020-10-28 01:19:04 +00:00			`TargetObject\|contains: 'SYSTEM\'`
Update mal_azorult_reg.yml 2020-10-28 01:18:41 +00:00			`TargetObject\|endswith: '\services\localNETService'`
Registry entry for Azorult malware Detects registry keys used by Azorult malware 2020-05-09 01:26:24 +00:00			`condition: selection`
			`fields:`
			`- Image`
			`- TargetObject`
			`- TargetDetails`
			`falsepositives:`
			`- unknown`
Changed level to ciritcal 2020-05-11 08:40:23 +00:00			`level: critical`