underminer_exploit_kit_delivers_malware

rule underminer_exploit_kit_delivers_malware {
 meta:
    author = "Emir Erdogan"
    description = "Underminer Exploit Kit Delivers Malware by using SSL Certificate Authority along with the SSL Subject of user.shorico.club  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/2RbeLqD41k0l"
    version = "0.01"
    created = "2021-03-09"
    product = "windows"
    service = "sysmon"
    mitre = "persistence, t1050, T1189"

  events:
(($selection1.target.process.file.full_path = "C:\\Windows\\System32\\regsvr32.exe" or $selection1.target.process.file.full_path = "C:\\Windows\\System32\\cmd.exe" or re.regex($selection1.target.process.file.full_path, `.*powershell\.exe.*`)) and $selection1.principal.process.file.full_path = "C:\\Program Files\\Internet Explorer\\iexplore.exe" and re.regex($selection1.target.process.command_line, `.*6ke4ua62j0vmgeq6ld84ri257o\.sct.*`))

  condition:
    $selection1
}