apt sofacy

Description

Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT28/proc_creation_win_apt_sofacy.yml Questions via Twitter: @janvonkirchheim.

Query · kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine matches regex @'rundll32\.exe %APPDATA%.*\.dat",'
     or ProcessCommandLine matches regex @'rundll32\.exe %APPDATA%.*\.dll",#1'
| top 100 by Timestamp desc
Raw source apt sofacy · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 36a6028d-f977-455f-be11-669e993a25d6
name: apt sofacy
description: |
  Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT28/proc_creation_win_apt_sofacy.yml
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where ProcessCommandLine matches regex @'rundll32\.exe %APPDATA%.*\.dat",'
       or ProcessCommandLine matches regex @'rundll32\.exe %APPDATA%.*\.dll",#1'
  | top 100 by Timestamp desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.