Elise backdoor

Description

Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Malware/Elise-Backdoor/proc_creation_win_malware_elise.yml Questions via Twitter: @janvonkirchheim.

Query · kql

DeviceProcessEvents 
| where Timestamp > ago(7d)
| where (FolderPath =~ @"C:\Windows\SysWOW64\cmd.exe" and ProcessCommandLine has @"\Windows\Caches\NavShExt.dll") 
     or (ProcessCommandLine endswith @"\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll,Setting")
| top 100 by Timestamp desc
Raw source Elise backdoor · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2a044f6d-a670-4977-9c7b-da556aa6c8d0
name: Elise backdoor
description: |
  Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Malware/Elise-Backdoor/proc_creation_win_malware_elise.yml
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  | where (FolderPath =~ @"C:\Windows\SysWOW64\cmd.exe" and ProcessCommandLine has @"\Windows\Caches\NavShExt.dll") 
       or (ProcessCommandLine endswith @"\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll,Setting")
  | top 100 by Timestamp desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.