north_korean_tunneling_tool__electricfish_detection_ar19129a

rule north_korean_tunneling_tool__electricfish_detection_ar19129a {
 meta:
    author = "Roman Ranskyi"
    description = "The malware implements a custom protocol that allows traffic to be funneled between a source and a destination Internet Protocol (IP) address. The malware continuously attempts to reach out to the source and the designation system, which allows either side to initiate a funneling session.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/Nn8PAznyKZpC"
    version = "0.01"
    created = "2019/05/14"
    product = "windows"
    service = "sysmon"
    mitre = "Exfiltration, Command and Control, t1179, t1002, t1090"

  events:
(($selection_hashes.metadata.product_event_type = "1" and ($selection_hashes.target.file.md5 = "08bb17d8e839e7fc92426e813a696e73" or $selection_hashes.target.file.md5 = "0939363ff55d914e92635e5f693099fb28047602" or $selection_hashes.target.file.md5 = "3549cfa19e60aa9239f79d80e19279fa" or $selection_hashes.target.file.md5 = "382715f8e776a544bf70f843a52e3ff2" or $selection_hashes.target.file.md5 = "3d3d7962d16652002018640a3fa27d44" or $selection_hashes.target.file.md5 = "5d25465ec4d51c6b61947990fb148d0b1ee8a344069d5ac956ef4ea6a61af879" or $selection_hashes.target.file.md5 = "6c3daca3c522ab98a8ac12a45087297c" or $selection_hashes.target.file.md5 = "7efe8a7ad9c6a6146bddd5aef9ceba477ca6973203a41f4b7f823095a90cb10f" or $selection_hashes.target.file.md5 = "871fb8486e5ea3307ff7b65ddf46518a" or $selection_hashes.target.file.md5 = "8d9123cd2648020292b5c35edc9ae22e" or $selection_hashes.target.file.md5 = "a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb" or $selection_hashes.target.file.md5 = "a3a1a43f0e631c10ab42e5404b61580e760e7d6f849ab8eb5848057a8c60cda2" or $selection_hashes.target.file.md5 = "b7f382ea7e6c9c8e737cb92551341e64")) or (re.regex($selection_hashes.target.process.command_line, `.*\.exe`) and $selection_hashes.target.process.command_line = "-s" and $selection_hashes.target.process.command_line = "-d" and $selection_hashes.target.process.command_line = "-p" and $selection_hashes.target.process.command_line = "-u" and $selection_hashes.target.process.command_line = "-pw"))

  condition:
    $selection_hashes
}