StrRAT-Malware-Persistence

id: fa9ef60d-4025-490b-94bd-5bff2aa3b4a7
name: StrRAT-Malware-Persistence
description: |
  StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Persistence
query: |
  DeviceProcessEvents
  | where InitiatingProcessFileName in~("java.exe","javaw.exe")
  | where FileName == 'cmd.exe' and ProcessCommandLine has_all("schtasks /create", "tn Skype")