SigmaHQ/rules/apt/apt_turla_commands.yml

---
action: global
title: Turla Group Lateral Movement 
status: experimental
description: Detects automated lateral movement by Turla group 
references:
    - https://securelist.com/the-epic-turla-operation/65545/
tags:
    - attack.lateral_movement
    - attack.g0010
author: Markus Neis
date: 2017/11/07
logsource:
   product: windows
   service: sysmon
falsepositives:
   - Unknown
---
detection:
   selection:
      EventID: 1
      CommandLine: 
         - 'net use \\%DomainController%\C$ "P@ssw0rd" *'
         - 'dir c:\*.doc* /s'
         - 'dir %TEMP%\*.exe'
   condition: selection
level: critical
---
detection:
   netCommand1:
      EventID: 1
      CommandLine: 'net view /DOMAIN'
   netCommand2:
      EventID: 1
      CommandLine: 'net session'
   netCommand3:
      EventID: 1
      CommandLine: 'net share'
   timeframe: 1m
   condition: netCommand1 | near netCommand2 and netCommand3 
level: medium