Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects a multi-stage attack chain associated with UAT-8837, a China-nexus APT group. It correlates several distinct activities: initial reconnaissance (pinging google.com, system enumeration via tasklist, netstat, whoami, quser, hostname, net user), modification of RDP RestrictedAdmin settings, Earthworm tunneling to public IP addresses on specific ports (1433, 443, 447, 448, 80), the use of Active Directory enumeration tools (SharpHound, Certipy, dsquery, dsget, setspn), deployment of post-compromise tools in staging directories (Desktop, Temp, public\music, Users\public\videos, Users\public\Music) often masquerading with .ico extensions, and the creation of backdoored user accounts or localgroup additions. The rule requires either Earthworm tunneling, a combination of AD reconnaissance and post-compromise tool deployment, or at least two distinct stages from initial reconnaissance, RDP modification, AD reconnaissance, post-compromise tools, and backdoored accounts to trigger a detection. This correlation aims to reduce false positives and identify advanced persistent threat activity.
Detects a malicious PDF dropper that uses specific objects and patterns indicative of malware activity.
Detects Cobalt Strike Beacon payloads, specifically those associated with the APT24 BADAUDIO campaign, by looking for a unique watermark hash in command-line arguments or specific beacon executable/DLL names during process creation. The rule targets the Cobalt Strike Beacon watermark hash "BeudtKgqnlm0Ruvf+VYxuw==" and a generic "Watermark_Hash" string, alongside process images ending with '\beacon.exe' or '\beacon.dll'.
Detects execution of BADAUDIO malware downloader used by APT24
Detects COM-based evasion techniques implemented in the Kazuar v3 loader (hpbprndiLOC.dll). This loader uses sophisticated patchless methods to bypass Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) without modifying memory pages, making detection more difficult. The evasion techniques include COM object manipulation using CoCreateInstance, CLSIDFromString, and IIDFromString to interact with COM objects that can disable ETW and AMSI. Instead of patching EventWrite or EtwEventWrite functions in memory, the loader uses COM interfaces to disable ETW providers without leaving memory modification artifacts. The loader also uses COM objects to disable AmsiScanBuffer functionality without directly patching the function, and implements indirect function calls through control flow redirection to evade static analysis and make reverse engineering more difficult. These techniques are particularly sophisticated because they avoid traditional memory patching methods that are easily detected by security tools. The rule detects processes loading hpbprndiLOC.dll that also show indicators of COM-based ETW/AMSI bypass attempts.
Detects the execution of a DLL that contains specific cryptographic function calls (SystemFunction036 or RtlGenRandom) and is launched by common DLL loading mechanisms (rundll32.exe, regsvr32.exe, or mshta.exe). This pattern is indicative of the BADAUDIO malware, a first-stage downloader used by APT24, which is known for using SystemFunction036 for cryptographic operations and being delivered as a DLL.
Detects the initial VBScript loader used in Turla's Kazuar v3 campaign. The loader script (8RWRLT.vbs) is executed via wscript.exe and creates a folder structure mimicking HP printer drivers at %LOCALAPPDATA%\Programs\HP\Printer\Driver. The script downloads multiple files from a remote C2 server including hpbprndi.exe (a legitimate signed HP driver), hpbprndiLOC.dll (the actual Kazuar loader), and encrypted payload files (jayb.dadk, kgjlj.sil, pkrfsu.ldy). The loader uses WinHttp.WinHttpRequest.5.1 COM object to download files while ignoring SSL certificate errors, and establishes persistence by creating a registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. This rule specifically looks for wscript.exe processes with command lines containing both the HP printer driver path and hpbprndi references, which are strong indicators of the Kazuar v3 loader execution.
Detects file creation events for specific files downloaded by the Turla Kazuar v3 loader. The malware downloads a set of files into the %LOCALAPPDATA%\Programs\HP\Printer\Driver directory including hpbprndi.exe (a legitimate signed Hewlett-Packard printer driver installer used as a loader with SHA256: 34b7df7919dbbe031b5d802accb566ce6e91df4155b1858c3c81e4c003f1168c), hpbprndiLOC.dll (the actual Kazuar v3 loader DLL that implements COM-based.
This rule detects various stages of the Remcos RAT campaign. It includes rules for initial access via Word documents with remote templates and RTF files exploiting CVE-2017-11882, VBScript loaders executing Base64-encoded PowerShell, .NET modules used for loading and persistence via scheduled tasks, the Remcos RAT payload itself (version 7.0.4 Pro) including indicators of process hollowing, network indicators for C2 communication, fileless execution techniques (PowerShell loading .NET from image, process hollowing), and persistence mechanisms like scheduled tasks and VBScript files in public downloads.
Detects data exfiltration activity by Turla's Kazuar v3 loader. After performing system reconnaissance, the VBScript loader sends collected information to the C2 server via HTTP POST requests. The exfiltration process collects system information including OS version, boot time, processor architecture, computer name, username, domain, running processes, and file listings, formats the data as plain text, and sends it via HTTP POST to the requestor.php endpoint on the C2 server. The loader uses WinHttp.WinHttpRequest.5.1 with SSL certificate validation disabled and sets User-Agent to "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)" to appear as legitimate browser traffic. The requestor.php endpoint is a specific indicator of Kazuar v3 C2 communication. This rule detects POST requests to this endpoint targeting any internet-routable IPv4 address, as Turla may use different C2 servers across campaigns. The combination of the specific endpoint name and POST method is a strong indicator of Kazuar v3 data exfiltration.
Page 94 of 98