SigmaHQ/rules/windows/process_creation/win_malware_trickbot_recon_activity.yml

title: Trickbot Malware Recon Activity
id: 410ad193-a728-4107-bc79-4419789fcbf8
status: experimental
description: Trickbot enumerates domain/network topology and executes certain commands automatically every few minutes. This detectors attempts to identify that activity based off a command rarely observed in an enterprise network.
references:
    - https://www.sneakymonkey.net/2019/05/22/trickbot-analysis/
    - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/
author: David Burkett, Florian Roth
date: 2019/12/28
modified: 2020/11/26
tags:
    - attack.discovery
    - attack.t1482
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\cmd.exe'
        Image|endswith:
            - '\nltest.exe'
        CommandLine|contains:
            - '/domain_trusts /all_trusts'
    condition: selection
falsepositives:
    - Rare System Admin Activity
level: critical