public_cyber_enemy_emotet_has_returned

Description

Detects Emotet License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.

Query · yara_l

events:
(($selection.metadata.product_event_type = "1" and ((re.regex($selection.target.process.file.full_path, `.*/powershell\.exe`) and re.regex($selection.target.process.command_line, `powersheLL -e .*[Net\.ServicePointManager]::\\\"SecuRiTYPrOTOcoL\\\" = .*sPlIT\\\"\([char]42\);.*DOWNLoADFIlE\\\".* {\([wmiclass]'win32_Process'\)\.\\\"crEAte\\\".*}
Raw source public_cyber_enemy_emotet_has_returned · YARA-L
Esc
Published by chronicle/detection-rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule public_cyber_enemy_emotet_has_returned {
 meta:
    author = "Osman Demir"
    description = "Detects Emotet  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/mX8YnI2czLHA"
    version = "0.01"
    created = "2021-03-09"
    product = "windows"
    service = "sysmon"
    mitre = "T1193, Initial_Access"

  events:
(($selection.metadata.product_event_type = "1" and ((re.regex($selection.target.process.file.full_path, `.*/powershell\.exe`) and re.regex($selection.target.process.command_line, `powersheLL -e .*[Net\.ServicePointManager]::\\\"SecuRiTYPrOTOcoL\\\" = .*sPlIT\\\"\([char]42\);.*DOWNLoADFIlE\\\".* {\([wmiclass]'win32_Process'\)\.\\\"crEAte\\\".*}}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.