APT Baby Shark

Description

Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/BabyShark/proc_creation_win_malware_babyshark.yml Questions via Twitter: @janvonkirchheim.

Query · kql

DeviceProcessEvents 
| where Timestamp > ago(7d)
| where ProcessCommandLine =~ @"reg query ""HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default""" 
     or ProcessCommandLine startswith "powershell.exe mshta.exe http"
     or ProcessCommandLine =~ "cmd.exe /c taskkill /im cmd.exe"
| top 100 by Timestamp desc
Raw source APT Baby Shark · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 26721b80-a9b7-4594-9b0f-ec21e5da1bc2
name: APT Baby Shark
description: |
  Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/BabyShark/proc_creation_win_malware_babyshark.yml
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  | where ProcessCommandLine =~ @"reg query ""HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default""" 
       or ProcessCommandLine startswith "powershell.exe mshta.exe http"
       or ProcessCommandLine =~ "cmd.exe /c taskkill /im cmd.exe"
  | top 100 by Timestamp desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.