data_seondbin_ransomware_detector_sysmon_behavior

rule data_seondbin_ransomware_detector_sysmon_behavior {
 meta:
    author = "Lee Archinal"
    description = "This content detects charactaristics of a strain of malware that focuses on 1data_seond.bin file  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/amTLjZ42fdAs"
    version = "0.01"
    created = "2019/06/13"
    product = "windows"
    service = "sysmon"
    mitre = "Impact, t1486"

  events:
($selection1.metadata.product_event_type = "1" and $selection1.target.process.file.full_path = "C:\\Windows\\System32\\mshta.exe" and (re.regex($selection1.target.process.command_line, `mshta\.exe \".*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info\.hta\" `) or $selection1.target.process.command_line = "mshta.exe \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.hta\"") and $selection1.metadata.product_event_type = "11" and ($selection1.target.file.full_path = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.hta" or $selection1.target.file.full_path = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1data_second.bin" or re.regex($selection1.target.file.full_path, `C:\\Users.*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1data_second\.bin`) or re.regex($selection1.target.file.full_path, `C:\\Users.*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info\.hta`)) and $selection1.metadata.product_event_type = "13" and re.regex($selection1.target.registry.registry_key, `.*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\1data_second\.bin`) and $selection1.target.registry.registry_value_data = "C:\\Windows\\Ssytem32\\1data_second.bin" and re.regex($selection1.target.registry.registry_key, `.*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\C:\\Windows\\Ssytem32\\Info\.hta`) and $selection1.target.registry.registry_value_data = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" and re.regex($selection1.target.registry.registry_key, `.*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\C:\\Users.*\\AppData\\Roaming\\Info\.hta`) and re.regex($selection1.target.registry.registry_value_data, `mashta\.exe \"C:\\Users.*\\AppData\\Roaming\\Info\.hta\"`))

  condition:
    $selection1
}