hiding-java-class-file

Description

This query was originally published in the threat analytics report, Adwind utilizes Java for cross-platform impact. Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices. The query below checks for attempts to disguise Java class files (i.e., complied code with a .class extension). Although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar defense evasion techniques. See Detecting a JAR attachment for an additional query that detects behavior associated with Adwind attacks.

Query · kql

union DeviceFileEvents, DeviceProcessEvents
| where ProcessCommandLine has "attrib +h +s +r " 
and ProcessCommandLine contains ".class"
Raw source hiding-java-class-file · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c5196191-609a-407f-a623-f37785eca019
name: hiding-java-class-file
description: |
  This query was originally published in the threat analytics report, Adwind utilizes Java for cross-platform impact.
  Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
  The query below checks for attempts to disguise Java class files (i.e., complied code with a .class extension). Although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar defense evasion techniques.
  See Detecting a JAR attachment for an additional query that detects behavior associated with Adwind attacks.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
  - DeviceProcessEvents
tactics:
- Defense evasion
query: |
  union DeviceFileEvents, DeviceProcessEvents
  | where ProcessCommandLine has "attrib +h +s +r " 
  and ProcessCommandLine contains ".class"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.