[rule]
description = "Identifies potential execution of a commercial spyware."
id = "051179c9-67cf-4182-8e58-18df7114f476"
license = "Elastic License v2"
name = "Potential DANTE Spyware Execution"
os_list = ["windows"]
reference = ["https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/"]
version = "1.0.2"
query = '''
registry where event.action == "query" and registry.value == "ComputerName" and
process.thread.Ext.call_stack_summary like "ntdll.dll*|kernelbase.dll|rpcrt4.dll|wevtapi.dll|*" and
_arraysearch(process.thread.Ext.call_stack, $entry,
$entry.callsite_trailing_bytes like ("488bd848894424384885c00f84bc0000008974244033c955e8*",
"4883c320483bdf????488b7dd8488b5dd0418bf6488b4de8483b4df0400f95c64885db????488bd7488bcb*"))
'''
min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.10.0"