SigmaHQ/rules/windows/malware/win_mal_adwind.yml
Thomas Patzke a3e02ea70f Various rule fixes
* Field name: LogonProcess -> LogonProcessName
* Field name: Message -> AuditPolicyChanges
* Field name: ProcessCommandLine -> CommandLine
* Removed Type match in Kerberos RC4 encryption rule
  Problematic because text representation not unified and audit failures are possibly interesting events
* Removed field 'Severity' from rules (Redundant)
* Rule decomposition of win_susp_failed_logons_single_source) because of different field names
* Field name: SubjectAccountName -> SubjectUserName
* Field name: TargetProcess -> TargetImage
* Field name: TicketEncryption -> TicketEncryptionType
* Field name: TargetFileName -> TargetFilename
2018-03-27 14:35:49 +02:00

56 lines
1.6 KiB
YAML

---
action: global
title: Adwind RAT / JRAT
status: experimental
description: Detects javaw.exe in AppData folder as used by Adwind / JRAT
references:
- https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
- https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
author: Florian Roth, Tom Ueltschi
date: 2017/11/10
detection:
condition: selection
level: high
---
# Windows Security Eventlog: Process Creation with Full Command Line
logsource:
product: windows
service: security
description: 'Requirements: Audit Policy : Detailed Tracking > Audit Process creation, Group Policy : Administrative Templates\System\Audit Process Creation'
detection:
selection:
EventID: 4688
CommandLine:
- '*\AppData\Roaming\Oracle*\java*.exe *'
- '*cscript.exe *Retrive*.vbs *'
---
# Sysmon: Process Creation (ID 1)
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 1
Image: '*\AppData\Roaming\Oracle\bin\java*.exe'
---
# Sysmon: File Creation (ID 11)
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 11
TargetFilename:
- '*\AppData\Roaming\Oracle\bin\java*.exe'
- '*\Retrive*.vbs'
---
# Sysmon: Registry Value Set (ID 13)
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 13
TargetObject: '\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*'
Details: '%AppData%\Oracle\bin\*'