kovter_malware_detector_sysmon_behavior

rule kovter_malware_detector_sysmon_behavior {
 meta:
    author = "Lee Archinal"
    description = "This content detects characteristics of the Kovter malware strain  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/ooS8hnliq9T3"
    version = "0.01"
    created = "2019/07/30"
    product = "windows"
    service = "sysmon"
    mitre = "execution, t1059, persistence, t1060"

  events:
(($selection1.metadata.product_event_type = "13" and ($selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE" or $selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\OSUPGRADE" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN" or $selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WindowsUpdate" or $selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\OSUpgrade" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\xvyg" or $selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\WOW6432NODE\\xvyg " or $selection1.target.registry.registry_key = "HKCR\\7b507" or $selection1.target.registry.registry_key = "HKCR\\7B507\\shell" or $selection1.target.registry.registry_key = "HKCR\\7B507\\SHELL\\open" or $selection1.target.registry.registry_key = "HKCR\\7B507\\SHELL\\OPEN\\command" or $selection1.target.registry.registry_key = "HKCR\\.16a05d" or $selection1.target.registry.registry_key = "HKCR\\.16A05D" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN" or $selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\9OVFKL4" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\IUV2K1GDZ" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\IUV2K1GDZ" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\TYG6ZX" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\5WGIB69" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\0wn0hDCj1e" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\0WN0HDCJ1E") and ($selection1.target.registry.registry_value_data = "CURAMV" or $selection1.target.registry.registry_value_data = "VuVY43ROT" or $selection1.target.registry.registry_value_data = "VR6KTbo" or $selection1.target.registry.registry_value_data = "49rU6evnxC" or $selection1.target.registry.registry_value_data = "Y4d5jxtm" or $selection1.target.registry.registry_value_data = "xSnk64X" or $selection1.target.registry.registry_value_data = "IxF25a" or $selection1.target.registry.registry_value_data = "DC1iXk9" or $selection1.target.registry.registry_value_data = "Blob" or $selection1.target.registry.registry_value_data = "vrxzdhbyv" or $selection1.target.registry.registry_value_data = "ssishoff" or $selection1.target.registry.registry_value_data = "ReservationsAllowed" or $selection1.target.registry.registry_value_data = "DisableOSUpgrade")) or ($selection1.metadata.product_event_type = "11" and (re.regex($selection1.target.file.full_path, `.*\\AppData\\Local\\39b03.*`) or re.regex($selection1.target.file.full_path, `.*\\AppData\\Local\\39b03\\6a5cc\.16a05d.*`) or re.regex($selection1.target.file.full_path, `.*\\AppData\\Local\\39b03\\7cbdf\.bat`) or re.regex($selection1.target.file.full_path, `.*\\Local Settings\\Application Data\\2501\\1ffa\.41d68`) or re.regex($selection1.target.file.full_path, `.*\\Local Settings\\Application Data\\2501\\aae7\.bat`))))

  condition:
    $selection1
}