rules-emerging-threats/2020/Malware/Blue-Mockingbird/registry_set_mal_blue_mockingbird.yml

title: Blue Mockingbird - Registry
id: 92b0b372-a939-44ed-a11b-5136cf680e27
related:
    - id: c3198a27-23a0-4c2c-af19-e5328d49680e
      type: derived
status: test
description: Attempts to detect system changes made by Blue Mockingbird
references:
    - https://redcanary.com/blog/blue-mockingbird-cryptominer/
author: Trent Liffick (@tliffick)
date: 2020-05-14
modified: 2023-08-17
tags:
    - attack.execution
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - attack.t1047
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|endswith: '\CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll'
    condition: selection
falsepositives:
    - Unknown
level: high
$frack113$ Update Title (#3731 ) 2022-11-27 19:19:27 +01:00			`title: Blue Mockingbird - Registry`
$frack113$ Split global rule 2021-09-11 13:45:41 +02:00			`id: 92b0b372-a939-44ed-a11b-5136cf680e27`
			`related:`
$frack113$ fix related 2021-09-11 14:22:01 +02:00			`- id: c3198a27-23a0-4c2c-af19-e5328d49680e`
			`type: derived`
Merge PR #4891 from @nasbench - Promote older rules status from `experimental` to `test` 2024-07-01 10:42:32 +02:00			`status: test`
$frack113$ Split global rule 2021-09-11 13:45:41 +02:00			`description: Attempts to detect system changes made by Blue Mockingbird`
			`references:`
			`- https://redcanary.com/blog/blue-mockingbird-cryptominer/`
			`author: Trent Liffick (@tliffick)`
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes 2024-08-12 12:02:50 +02:00			`date: 2020-05-14`
			`modified: 2023-08-17`
$frack113$ Order yaml field 2022-10-26 06:16:55 +02:00			`tags:`
			`- attack.execution`
Merge PR #5395 from @david-syk - Update MITRE ATT&CK tags 2025-05-20 23:05:21 +02:00			`- attack.persistence`
Merge PR #5966 from @nasbench - Update mitre tags to use attack v19 2026-04-29 01:20:23 +02:00			`- attack.defense-impairment`
$frack113$ Order yaml field 2022-10-26 06:16:55 +02:00			`- attack.t1112`
			`- attack.t1047`
Merge PR #5740 from @swachchhanda000 - chore: reorganize threat specific rules into rules-emerging-threats directory 2025-11-10 16:45:08 +05:45			`- detection.emerging-threats`
$frack113$ Split global rule 2021-09-11 13:45:41 +02:00			`logsource:`
$frack113$ Order yaml field 2022-10-26 06:16:55 +02:00			`product: windows`
			`category: registry_set`
$frack113$ Split global rule 2021-09-11 13:45:41 +02:00			`detection:`
$frack113$ Order yaml field 2022-10-26 06:16:55 +02:00			`selection:`
			`TargetObject\|endswith: '\CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll'`
			`condition: selection`
$frack113$ Split global rule 2021-09-11 13:45:41 +02:00			`falsepositives:`
fix: unknown --> Unknown 2022-03-16 13:43:54 +01:00			`- Unknown`
$frack113$ Update logsource 2022-03-26 16:57:58 +01:00			`level: high`