2020-03-26 14:13:52 +00:00
|
|
|
title: Judgement Panda Credential Access Activity
|
2019-11-12 22:12:27 +00:00
|
|
|
id: b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee
|
2019-02-27 21:05:27 +00:00
|
|
|
description: Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike
|
2019-02-21 08:54:01 +00:00
|
|
|
references:
|
2019-03-01 23:14:20 +00:00
|
|
|
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
|
2019-02-21 08:54:01 +00:00
|
|
|
author: Florian Roth
|
2019-02-27 21:05:27 +00:00
|
|
|
date: 2019/02/21
|
2020-08-27 17:43:47 +00:00
|
|
|
modified: 2020/08/26
|
2019-02-27 21:05:27 +00:00
|
|
|
tags:
|
2019-03-01 23:14:20 +00:00
|
|
|
- attack.credential_access
|
2020-08-27 17:43:47 +00:00
|
|
|
- attack.t1081 # an old one
|
|
|
|
- attack.t1003 # an old one
|
2020-06-16 20:46:08 +00:00
|
|
|
- attack.t1552.001
|
2020-08-27 17:43:47 +00:00
|
|
|
- attack.t1003.003
|
2019-02-27 21:05:27 +00:00
|
|
|
logsource:
|
2019-03-01 23:14:20 +00:00
|
|
|
category: process_creation
|
|
|
|
product: windows
|
2019-02-21 08:54:01 +00:00
|
|
|
detection:
|
2019-03-01 23:14:20 +00:00
|
|
|
selection1:
|
2020-10-15 20:24:56 +00:00
|
|
|
Image|endswith: '\xcopy.exe'
|
2020-10-28 02:26:34 +00:00
|
|
|
CommandLine|contains|all:
|
|
|
|
- '/S'
|
|
|
|
- '/E'
|
|
|
|
- '/C'
|
|
|
|
- '/Q'
|
|
|
|
- '/H'
|
|
|
|
- '\\'
|
2019-03-01 23:14:20 +00:00
|
|
|
selection2:
|
2020-10-15 20:24:56 +00:00
|
|
|
Image|endswith: '\adexplorer.exe'
|
2020-10-28 02:26:34 +00:00
|
|
|
CommandLine|contains|all:
|
|
|
|
- '-snapshot'
|
|
|
|
- '""'
|
2020-11-27 01:59:35 +00:00
|
|
|
- 'c:\users\'
|
2019-03-01 23:14:20 +00:00
|
|
|
condition: selection1 or selection2
|
2019-02-21 08:54:01 +00:00
|
|
|
falsepositives:
|
2019-03-01 23:14:20 +00:00
|
|
|
- unknown
|
2019-02-21 08:54:01 +00:00
|
|
|
level: critical
|