gh0strat_malware_detector_sysmon_behavior_july_2019

Description

This content detects characteristics of the Gh0stRAT Malware that was found in July 2019 License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.

Query · yara_l

events:
(((($selection1.metadata.product_event_type = "13" and (((($selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\System Remote Data" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\System Remote Data\\Parameters" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\System Remote Data" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SRDSL" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SRDSL\\Parameters" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SRDSL") or ($selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SRDSL" and ($selection1.metadata.description = "ImagePath" or $selection1.metadata.description = "Description" or $selection1.metadata.description = "SRDSL" or $selection1.metadata.description = "Group" or $selection1.metadata.description = "Type" or $selection1.metadata.description = "Start" or $selection1.metadata.description = "ErrorControl"))) or ($selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SYSTEM REMOTE DATA" and ($selection1.metadata.description = "Description" or $selection1.metadata.description = "Group" or $selection1.metadata.description = "InstallTime" or $selection1.metadata.description = "Type" or $selection1.metadata.description = "Start" or $selection1.metadata.description = "ErrorControl" or $selection1.metadata.description = "ImagePath" or $selection1.metadata.description = "DisplayName" or $selection1.metadata.description = "WOW64" or $selection1.metadata.description = "ObjectName" or $selection1.metadata.description = "FailureActions"))) or ($selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST" and $selection1.metadata.description = "System Remote Data"))) or ($selection1.metadata.product_event_type = "11" and (re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\System Remote Data\.exe`) or re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\SRDSL\.exe`) or re.regex($selection1.target.file.full_path, `.*\\Google\\28484\.dll`) or re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\System\. Remote\. Data\.\.exe`) or re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\en-US\\svchost\.exe\.mui`) or re.regex($selection1.target.file.full_path, `.*\\Google\\32640\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\29703\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\661453\.dll`) or re.regex($selection1.target.file.full_path, `.*\\660125\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\638859\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\693828\.dll`) or re.regex($selection1.target.file.full_path, `.*\\StormII\\668515\.dll`) or re.regex($selection1.target.file.full_path, `.*\\33625\.dll`) or re.regex($selection1.target.file.full_path, `.*\\DRM\\32046\.dll`) or re.regex($selection1.target.file.full_path, `.*\\30421\.dll`) or re.regex($selection1.target.file.full_path, `.*\\DRM\\36265\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\32812\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\33718\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\28281\.dll`) or re.regex($selection1.target.file.full_path, `.*\\%ProgramFiles%\\33234\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\32250\.dll`) or re.regex($selection1.target.file.full_path, `.*\\-1672280194\.dll`) or re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\System Rem2ote Data\.exe`)))) or ($selection1.metadata.product_event_type = "1" and (re.regex($selection1.target.process.file.full_path, `.*\\System Remote Data\.exe`) or re.regex($selection1.target.process.file.full_path, `.*\\SysWOW64\\SRDSL\.exe`) or re.regex($selection1.target.process.file.full_path, `.*\\SysWOW64\\System\. Remote\. Data\.\.exe`) or re.regex($selection1.target.process.file.full_path, `.*\\SysWOW64\\System Rem2ote Data\.exe`)))) or ($selection1.metadata.product_event_type = "7" and (re.regex($selection1.target.process.file.full_path, `.*\\Google\\28484\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\32640\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\29703\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\661453\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\660125\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\638859\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\693828\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\StormII\\668515\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\33625\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\DRM\\32046\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\30421\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\DRM\\36265\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\32812\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\33718\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\28281\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\%ProgramFiles%\\33234\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\32250\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\-1672280194\.dll`))))

  condition:
    $selection1
Raw source gh0strat_malware_detector_sysmon_behavior_july_2019 · YARA-L
Esc
Published by chronicle/detection-rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule gh0strat_malware_detector_sysmon_behavior_july_2019 {
 meta:
    author = "Lee Archinal"
    description = "This content detects characteristics of the Gh0stRAT Malware that was found in July 2019  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/sEWWYnbKsZ4m"
    version = "0.01"
    created = "2019/08/07"
    product = "windows"
    service = "sysmon"
    mitre = "defense_evasion, persistence, t1112, t1060"

  events:
(((($selection1.metadata.product_event_type = "13" and (((($selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\System Remote Data" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\System Remote Data\\Parameters" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\System Remote Data" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SRDSL" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SRDSL\\Parameters" or $selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SRDSL") or ($selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SRDSL" and ($selection1.metadata.description = "ImagePath" or $selection1.metadata.description = "Description" or $selection1.metadata.description = "SRDSL" or $selection1.metadata.description = "Group" or $selection1.metadata.description = "Type" or $selection1.metadata.description = "Start" or $selection1.metadata.description = "ErrorControl"))) or ($selection1.target.registry.registry_key = "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SYSTEM REMOTE DATA" and ($selection1.metadata.description = "Description" or $selection1.metadata.description = "Group" or $selection1.metadata.description = "InstallTime" or $selection1.metadata.description = "Type" or $selection1.metadata.description = "Start" or $selection1.metadata.description = "ErrorControl" or $selection1.metadata.description = "ImagePath" or $selection1.metadata.description = "DisplayName" or $selection1.metadata.description = "WOW64" or $selection1.metadata.description = "ObjectName" or $selection1.metadata.description = "FailureActions"))) or ($selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST" and $selection1.metadata.description = "System Remote Data"))) or ($selection1.metadata.product_event_type = "11" and (re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\System Remote Data\.exe`) or re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\SRDSL\.exe`) or re.regex($selection1.target.file.full_path, `.*\\Google\\28484\.dll`) or re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\System\. Remote\. Data\.\.exe`) or re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\en-US\\svchost\.exe\.mui`) or re.regex($selection1.target.file.full_path, `.*\\Google\\32640\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\29703\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\661453\.dll`) or re.regex($selection1.target.file.full_path, `.*\\660125\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\638859\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\693828\.dll`) or re.regex($selection1.target.file.full_path, `.*\\StormII\\668515\.dll`) or re.regex($selection1.target.file.full_path, `.*\\33625\.dll`) or re.regex($selection1.target.file.full_path, `.*\\DRM\\32046\.dll`) or re.regex($selection1.target.file.full_path, `.*\\30421\.dll`) or re.regex($selection1.target.file.full_path, `.*\\DRM\\36265\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\32812\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\33718\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\28281\.dll`) or re.regex($selection1.target.file.full_path, `.*\\%ProgramFiles%\\33234\.dll`) or re.regex($selection1.target.file.full_path, `.*\\Google\\32250\.dll`) or re.regex($selection1.target.file.full_path, `.*\\-1672280194\.dll`) or re.regex($selection1.target.file.full_path, `.*\\SysWOW64\\System Rem2ote Data\.exe`)))) or ($selection1.metadata.product_event_type = "1" and (re.regex($selection1.target.process.file.full_path, `.*\\System Remote Data\.exe`) or re.regex($selection1.target.process.file.full_path, `.*\\SysWOW64\\SRDSL\.exe`) or re.regex($selection1.target.process.file.full_path, `.*\\SysWOW64\\System\. Remote\. Data\.\.exe`) or re.regex($selection1.target.process.file.full_path, `.*\\SysWOW64\\System Rem2ote Data\.exe`)))) or ($selection1.metadata.product_event_type = "7" and (re.regex($selection1.target.process.file.full_path, `.*\\Google\\28484\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\32640\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\29703\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\661453\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\660125\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\638859\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\693828\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\StormII\\668515\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\33625\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\DRM\\32046\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\30421\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\DRM\\36265\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\32812\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\33718\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\28281\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\%ProgramFiles%\\33234\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\Google\\32250\.dll`) or re.regex($selection1.target.process.file.full_path, `.*\\-1672280194\.dll`))))

  condition:
    $selection1
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.