mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
58 lines
3.1 KiB
JSON
58 lines
3.1 KiB
JSON
{
|
|
"category": "Malware",
|
|
"channel": "ESCU",
|
|
"creation_date": "2018-09-11",
|
|
"description": "Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.",
|
|
"id": "bb9f5ed2-916e-4364-bb6d-91c310efcf52",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2018-09-11",
|
|
"name": "Emotet Malware (TA18-201A)",
|
|
"narrative": "The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. <br></br>According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.<br></br>The searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment. ",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://www.us-cert.gov/ncas/alerts/TA18-201A",
|
|
"https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf",
|
|
"https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable Info",
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"Detect Rare Executables",
|
|
"Registry Keys Used For Persistence",
|
|
"Detect Use of cmd.exe to Launch Script Interpreters",
|
|
"Prohibited Software On Endpoint",
|
|
"SMB Traffic Spike",
|
|
"Suspicious Email Attachment Extensions",
|
|
"Email Attachments With Lots Of Spaces",
|
|
"Detection of tools built by NirSoft"
|
|
],
|
|
"investigative_searches": [
|
|
"Get Process Info",
|
|
"Get Parent Process Info",
|
|
"Investigate Web Activity From Host"
|
|
],
|
|
"support_searches": []
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|