detect-doublepulsar-execution

Description

This query was originally published in the threat analytics report, Motivated miners. Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available. The following query detects possible DoublePulsar execution events. See Detect web server exploitation by DoublePulsar for a query that detects behaviors associated with campaigns that use DoublePulsar. References: https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036 https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/ https://support.microsoft.com/help/4013389/title

Query · kql

//DoublePulsar execution
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA1 == "be855cd1bfc1e1446a3390c693f29e2a3007c04e" or
(ProcessCommandLine contains "targetport" and ProcessCommandLine contains "targetip" and
(ProcessCommandLine contains "payload" or ProcessCommandLine contains "verifybackdoor"))
Raw source detect-doublepulsar-execution · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 10a17179-d143-476d-80cd-c5a6cca66d59
name: detect-doublepulsar-execution
description: |
  This query was originally published in the threat analytics report, Motivated miners.
  Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
  The following query detects possible DoublePulsar execution events.
  See Detect web server exploitation by DoublePulsar for a query that detects behaviors associated with campaigns that use DoublePulsar.
  References:
  https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
  https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
  https://support.microsoft.com/help/4013389/title
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  //DoublePulsar execution
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where SHA1 == "be855cd1bfc1e1446a3390c693f29e2a3007c04e" or
  (ProcessCommandLine contains "targetport" and ProcessCommandLine contains "targetip" and
  (ProcessCommandLine contains "payload" or ProcessCommandLine contains "verifybackdoor"))

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.