wastedlocker_ransomware_hunting_defense_evasion

rule wastedlocker_ransomware_hunting_defense_evasion {
 meta:
    author = "Ariel Millahuel"
    description = "This rule its part of Cisco Talos investigation about this ransomware, and includes a lot of ATT&CK techniques that i'll be writing in different rules.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/kNavqYGJrev8"
    version = "0.01"
    created = "2021-03-09"
    category = "process_creation"
    product = "windows"
    mitre = "defense_evasion, T1027.004, T1070.001"

  events:
(($selection1.metadata.product_event_type = "4688" or $selection1.metadata.product_event_type = "1") and ((($selection1.target.process.file.full_path = "cvtres.exe" and re.regex($selection1.target.process.command_line, `.*cvtres\.exe /NOLOGO /READONLY /MACHINE:.* /OUT:C:\\Users.*\\AppData\\Local\\Temp\\RESF8F4\.tmp c:\\Users.*\\AppData\\Local\\Temp\\h4bie4kg\\CSC81E10858D57A44649763EE5728D5E87\.TMP.*`)) or ($selection1.target.process.file.full_path = "PsExec.exe.exe" and re.regex($selection1.target.process.command_line, `PsExec\.exe -s .* cmd /c for /F tokens=.* %1 in \('wevtutil\.exe el'\) DO wevtutil\.exe cl %1`))) or ($selection1.target.process.file.full_path = "csc.exe" and re.regex($selection1.target.process.command_line, `csc\.exe /noconfig /fullpaths @C:\\Users.*\\AppData\\Local\\Temp\\h4bie4kg\\h4bie4kg\.cmdline`))))

  condition:
    $selection1
}