Zip-Doc - Creation of JPG Payload File

Description

In the campaign where Bazarloader is delivered via emails containing pw protected zip attachments, regsvr32.exe is used to launch a malicious payload that is disguised as a JPG file.

Query · kql

DeviceImageLoadEvents
| where InitiatingProcessFileName =~ "regsvr32.exe" and InitiatingProcessCommandLine has ".jpg" and FileName endswith ".jpg"
| summarize by FileName, SHA256, DeviceId, bin(Timestamp, 1d)
Raw source Zip-Doc - Creation of JPG Payload File · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: b760519d-392b-4baf-a2d6-087dc302de1c
name: Zip-Doc - Creation of JPG Payload File
description: |
  In the campaign where Bazarloader is delivered via emails containing pw protected zip attachments, regsvr32.exe is used to launch a malicious payload that is disguised as a JPG file.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceImageLoadEvents
tactics:
- Execution
query: |
  DeviceImageLoadEvents
  | where InitiatingProcessFileName =~ "regsvr32.exe" and InitiatingProcessCommandLine has ".jpg" and FileName endswith ".jpg"
  | summarize by FileName, SHA256, DeviceId, bin(Timestamp, 1d)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.