rule: Lazarus group loaders

rules/windows/process_creation/win_apt_lazarus_loader.yml

@@ -0,0 +1,39 @@
+title: Lazarus Loaders
+id: 7b49c990-4a9a-4e65-ba95-47c9cc448f6e
+description: Detects different loaders as described in various threat reports on Lazarus group activity
+status: experimental
+references:
+    - https://www.hvs-consulting.de/lazarus-report/
+    - https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/
+tags:
+    - attack.g0032
+author: Florian Roth
+date: 2020/12/23
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_cmd1:
+        CommandLine|contains|all: 
+            - 'cmd.exe /c '
+            - ' -p 0x'
+    selection_cmd2:
+        CommandLine|contains:
+            - 'C:\ProgramData\\'
+            - 'C:\RECYCLER\\'
+    selection_rundll1:
+        CommandLine|contains|all: 
+            - 'rundll32.exe '
+            - 'C:\ProgramData\\'
+    selection_rundll3:
+        CommandLine|contains:
+            - '.bin,'
+            - '.tmp,'
+            - '.dat,'
+            - '.io,'
+            - '.ini,'
+            - '.db,'
+    condition: ( selection_cmd1 and selection_cmd2 ) or ( selection_rundll1 and selection_rundll2 )
+falsepositives:
+    - unknown
+level: critical