From 280a70ea1efa5e573e15274231929e2396c28af7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 10 Nov 2022 09:59:43 +0100 Subject: [PATCH 01/10] cisa_coverage --- .../executables_or_script_creation_in_suspicious_path.yml | 4 +++- .../process_creating_lnk_file_in_suspicious_location.yml | 2 ++ detections/endpoint/rundll_loading_dll_by_ordinal.yml | 2 ++ detections/endpoint/suspicious_process_file_path.yml | 2 ++ detections/endpoint/windows_iso_lnk_file_creation.yml | 2 ++ .../windows_modify_registry_qakbot_binary_data_registry.yml | 4 ++-- .../endpoint/windows_phishing_recent_iso_exec_registry.yml | 2 ++ .../endpoint/windows_process_injection_remote_thread.yml | 4 ++-- 8 files changed, 17 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index f7ddc36c9d..aef81e69e8 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 version: 1 -date: '2021-05-06' +date: '2021-10-06' author: Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -33,6 +33,7 @@ known_false_positives: Administrators may allow creation of script or exe in the references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://twitter.com/pr0xylife/status/1590394227758104576 tags: analytic_story: - Double Zero Destructor @@ -47,6 +48,7 @@ tags: - Brute Ratel C4 - AgentTesla - Qakbot + - IcedID automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 87e4c99fa4..f586c5da48 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -30,10 +30,12 @@ known_false_positives: This detection should yield little or no false positive r references: - https://attack.mitre.org/techniques/T1566/001/ - https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html +- https://twitter.com/pr0xylife/status/1590394227758104576 tags: analytic_story: - Spearphishing Attachments - Qakbot + - IcedID asset_type: Endpoint cis20: - CIS 7 diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 9058357029..2deec4a798 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -30,11 +30,13 @@ known_false_positives: False positives are possible with native utilities and th references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://twitter.com/M_haggis/status/1491109262428635136 + - https://twitter.com/pr0xylife/status/1590394227758104576 tags: analytic_story: - Unusual Processes - Suspicious Rundll32 Activity - Living Off The Land + - IcedID asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 6b4b5760a5..d094ae78b2 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -30,6 +30,7 @@ known_false_positives: Administrators may allow execution of specific binaries i references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://twitter.com/pr0xylife/status/1590394227758104576 tags: analytic_story: - Data Destruction @@ -43,6 +44,7 @@ tags: - Brute Ratel C4 - AgentTesla - Qakbot + - IcedID automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index c2c8f98add..a3bdb3d472 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -24,6 +24,8 @@ tags: - Spearphishing Attachments - Brute Ratel C4 - AgentTesla + - Qakbot + - IcedID asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml index c8752f24d6..6ed96c32e3 100644 --- a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml +++ b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml @@ -1,7 +1,7 @@ name: Windows Modify Registry Qakbot Binary Data Registry id: 2e768497-04e0-4188-b800-70dd2be0e30d version: 1 -date: '2022-10-21' +date: '2022-11-10' author: Teoderick Contreras, Bhavin Patel, Splunk type: Anomaly datamodel: @@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count dc(registry_value_name) | where registry_key_name_len < 80 AND registry_value_name_len == 8 | join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("explorer.exe", "wermgr.exe","dxdiag.exe") + where Processes.process_name IN ("explorer.exe", "wermgr.exe","dxdiag.exe", "OneDriveSetup.exe", "mobsync.exe", "msra.exe", "xwizard.exe") by _time span=1m Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid Processes.process_path | `drop_dm_object_name(Processes)` | rename process_guid as proc_guid diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index cd534de3c2..bb15e4bad3 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -30,6 +30,8 @@ tags: analytic_story: - Brute Ratel C4 - AgentTesla + - Qakbot + - IcedID asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 004d3e9656..1357bd973e 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,7 +1,7 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 version: 1 -date: '2022-10-27' +date: '2022-11-10' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -10,7 +10,7 @@ description: The following analytic identifies a suspicious remote thread execut qakbot. Qakbot is one of the malware using this technique to load its malicious dll module or malicious code in the targeted host. This TTP can be a good pivot to verify what is the behavior of the targeted Image process after this detection trigger. look for network connection, child process execution, file access and many more that helps to verify the indication of malware infection. -search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe") +search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe") | stats count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId SourceProcessId EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From d9c8fee940a642ba5c44fd722ecb80854b0c1d3b Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 10 Nov 2022 11:45:57 +0100 Subject: [PATCH 02/10] cisa_coverage --- ...ws_app_layer_protocol_qakbot_namedpipe.yml | 72 +++++++++++++++++++ ...p_layer_protocol_qakbot_namedpipe.test.yml | 13 ++++ 2 files changed, 85 insertions(+) create mode 100644 detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml create mode 100644 tests/endpoint/windows_app_layer_protocol_qakbot_namedpipe.test.yml diff --git a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml new file mode 100644 index 0000000000..6409d58423 --- /dev/null +++ b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml @@ -0,0 +1,72 @@ +name: Windows App Layer Protocol Qakbot NamedPipe +id: 63a2c15e-9448-43c5-a4a8-9852266aaada +version: 1 +date: '2022-11-10' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a suspicious process creating or connecting to a possible Qakbot named pipe . + This technique was seen in Qakbot malware that creates named pipe after injecting its code in legitimate process to communicate + on other process that also has an injected code to steal information on the compromised host. This Anomaly detection can be a + good pivot for possible Qakbot infection. This detection looks for possible random generated named pipe (in GUID form) created by known process + being abused by Qakbot. +search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") + Image IN ("*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe") + | regex PipeName="^\\\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{8}" + | stats min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessGuid ProcessId PipeName SecurityID EventCode Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_app_layer_protocol_qakbot_namedpipe_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, pipename, processguid and named pipe event type from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://strontic.github.io/xcyclopedia/library/wermgr.exe-0F652BF7ADA772981E8AAB0D108FCC92.html +- https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html +- https://www.elastic.co/security-labs/qbot-malware-analysis +tags: + analytic_story: + - Qakbot + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Command And Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: $Image$ is creating or connecting to a named pipe $PipeName$ in $Computer$ + mitre_attack_id: + - T1071 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - EventType + - ProcessGuid + - ProcessId + - PipeName + - Computer + - UserID + - SecurityID + risk_score: 49 + security_domain: endpoint diff --git a/tests/endpoint/windows_app_layer_protocol_qakbot_namedpipe.test.yml b/tests/endpoint/windows_app_layer_protocol_qakbot_namedpipe.test.yml new file mode 100644 index 0000000000..3b36af067d --- /dev/null +++ b/tests/endpoint/windows_app_layer_protocol_qakbot_namedpipe.test.yml @@ -0,0 +1,13 @@ +name: Windows App Layer Protocol Qakbot NamedPipe Unit Test +tests: +- name: Windows App Layer Protocol Qakbot NamedPipe + file: endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 3dcec803a023355d513fa5d3731a3edcff044e39 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 11 Nov 2022 14:25:39 +0100 Subject: [PATCH 03/10] Update windows_iso_lnk_file_creation.yml --- detections/endpoint/windows_iso_lnk_file_creation.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index a3bdb3d472..d74e99f947 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -19,6 +19,7 @@ known_false_positives: False positives may be high depending on the environment references: - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1 +- https://isc.sans.edu/diary/Recent+AZORult+activity/25120 tags: analytic_story: - Spearphishing Attachments @@ -26,6 +27,7 @@ tags: - AgentTesla - Qakbot - IcedID + - Azorult asset_type: Endpoint cis20: - CIS 3 From 11fb8d9f204bf7ae99ad5c2d3c08fa873f744854 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 11 Nov 2022 14:25:57 +0100 Subject: [PATCH 04/10] Update windows_phishing_recent_iso_exec_registry.yml --- .../endpoint/windows_phishing_recent_iso_exec_registry.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index bb15e4bad3..c8491bfa03 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -26,12 +26,14 @@ known_false_positives: False positives may be high depending on the environment references: - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ +- https://isc.sans.edu/diary/Recent+AZORult+activity/25120 tags: analytic_story: - Brute Ratel C4 - AgentTesla - Qakbot - IcedID + - Azorult asset_type: Endpoint cis20: - CIS 3 From 4160527799ddd7b9ec1c522e0e72ee450f6e0a14 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 11 Nov 2022 14:27:57 +0100 Subject: [PATCH 05/10] cisa_coverage --- detections/endpoint/office_document_executing_macro_code.yml | 2 ++ detections/endpoint/office_product_spawn_cmd_process.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index d1f9a35ae9..8d995d745a 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -26,6 +26,7 @@ known_false_positives: Normal Office Document macro use for automation references: - https://www.joesandbox.com/analysis/386500/0/html - https://www.joesandbox.com/analysis/702680/0/html +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ tags: analytic_story: - Spearphishing Attachments @@ -34,6 +35,7 @@ tags: - DarkCrystal RAT - AgentTesla - Qakbot + - Azorult confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index ee2c24c7c4..1d80a2617c 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -27,10 +27,12 @@ known_false_positives: IT or network admin may create an document automation tha will run shell script. references: - https://twitter.com/cyb3rops/status/1416050325870587910?s=21 +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ tags: analytic_story: - Trickbot - DarkCrystal RAT + - Azorult confidence: 80 context: - Source:Endpoint From d7830ab5231b5a79323ad20855f28b4331d1b090 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 11 Nov 2022 15:19:02 +0100 Subject: [PATCH 06/10] Update office_document_executing_macro_code.yml --- detections/endpoint/office_document_executing_macro_code.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 8d995d745a..bc5e992a48 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -27,6 +27,7 @@ references: - https://www.joesandbox.com/analysis/386500/0/html - https://www.joesandbox.com/analysis/702680/0/html - https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing tags: analytic_story: - Spearphishing Attachments @@ -36,6 +37,7 @@ tags: - AgentTesla - Qakbot - Azorult + - Remcos confidence: 50 context: - Source:Endpoint From f05df4e44650bb4080aaf1d1ee7f3ceb534c0207 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 11 Nov 2022 15:19:20 +0100 Subject: [PATCH 07/10] Update office_product_spawn_cmd_process.yml --- detections/endpoint/office_product_spawn_cmd_process.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 1d80a2617c..9cde991f53 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -28,11 +28,13 @@ known_false_positives: IT or network admin may create an document automation tha references: - https://twitter.com/cyb3rops/status/1416050325870587910?s=21 - https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing tags: analytic_story: - Trickbot - DarkCrystal RAT - Azorult + - Remcos confidence: 80 context: - Source:Endpoint From 4bceed97461967eca1f37cbf5d1885eb044ea982 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 11 Nov 2022 15:20:55 +0100 Subject: [PATCH 08/10] cisa_coverage --- .../endpoint/office_product_spawning_windows_script_host.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml index 9c2dba2783..5794eb6433 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/endpoint/office_product_spawning_windows_script_host.yml @@ -18,9 +18,11 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed. references: - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ + - https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing tags: analytic_story: - Spearphishing Attachments + - Remcos confidence: 90 context: - Source:Endpoint From 30c28931e46a549efd6ffe0babad783c9775a4ec Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 11 Nov 2022 15:23:46 +0100 Subject: [PATCH 09/10] Update windows_phishing_recent_iso_exec_registry.yml --- .../endpoint/windows_phishing_recent_iso_exec_registry.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index c8491bfa03..2261d05d7a 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -27,6 +27,7 @@ references: - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ - https://isc.sans.edu/diary/Recent+AZORult+activity/25120 +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html tags: analytic_story: - Brute Ratel C4 @@ -34,6 +35,7 @@ tags: - Qakbot - IcedID - Azorult + - Remcos asset_type: Endpoint cis20: - CIS 3 From 7c90ef4ca053583aba80a44a6f91b1f4b23b0d82 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 11 Nov 2022 15:24:11 +0100 Subject: [PATCH 10/10] Update windows_iso_lnk_file_creation.yml --- detections/endpoint/windows_iso_lnk_file_creation.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index d74e99f947..50a6a9e226 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -20,6 +20,7 @@ references: - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1 - https://isc.sans.edu/diary/Recent+AZORult+activity/25120 +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html tags: analytic_story: - Spearphishing Attachments @@ -28,6 +29,7 @@ tags: - Qakbot - IcedID - Azorult + - Remcos asset_type: Endpoint cis20: - CIS 3