SigmaHQ/rules/apt/apt_turla_commands.yml

---
action: global
title: Turla Group Lateral Movement 
status: experimental
description: Detects automated lateral movement by Turla group 
references:
    - https://securelist.com/the-epic-turla-operation/65545/
tags:
    - attack.lateral_movement
    - attack.g0010
author: Markus Neis
date: 2017/11/07
logsource:
    category: process_creation
    product: windows
falsepositives:
   - Unknown
---
detection:
   selection:
      CommandLine: 
         - 'net use \\%DomainController%\C$ "P@ssw0rd" *'
         - 'dir c:\\*.doc* /s'
         - 'dir %TEMP%\\*.exe'
   condition: selection
level: critical
---
detection:
   netCommand1:
      CommandLine: 'net view /DOMAIN'
   netCommand2:
      CommandLine: 'net session'
   netCommand3:
      CommandLine: 'net share'
   timeframe: 1m
   condition: netCommand1 | near netCommand2 and netCommand3 
level: medium