Gootkit-malware

id: c8796d76-9a84-4cc8-91b5-d01f882869d4
name: Gootkit-malware
description: |
  This query was originally published on Twitter, by @MsftSecIntel.
  Gootkit is malware that started life as a banking trojan, and has since extended its capabilities to allow for a variety of malicious activities.
  The query helps find events related to Gootkit downloads and command-and-control behavior.
  Reference - https://twitter.com/MsftSecIntel
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
  - DeviceNetworkEvents
tactics:
- Command and control
query: |
  AlertInfo | where Title =~ "Suspected delivery of Gootkit malware"
  // Below section is to surface active follow-on Command and Control as a result of the above behavior. Comment out the below joins to see
  // only file create events where the malware may be present but has not yet been executed.
  ////
  // Get alert evidence
  | join AlertEvidence on $left.AlertId == $right.AlertId
  // Look for C2
  | join DeviceNetworkEvents  on $left.DeviceId == $right.DeviceId
  | where InitiatingProcessFileName =~ "wscript.exe" and InitiatingProcessCommandLine has ".zip" and InitiatingProcessCommandLine has ".js"
  | summarize by RemoteUrl, RemoteIP , DeviceId, InitiatingProcessCommandLine, Timestamp, 
  InitiatingProcessFileName, AlertId, Title, AccountName