rules/apt/crime_fireball.yml

title: Fireball Archer Install
id: 3d4aebe0-6d29-45b2-a8a4-3dfde586a26d
status: experimental
description: Detects Archer malware invocation via rundll32
author: Florian Roth
date: 2017/06/03
references:
    - https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/
    - https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100
tags:
    - attack.execution
    - attack.t1059
    - attack.defense_evasion
    - attack.t1085
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine: '*\rundll32.exe *,InstallArcherSvc'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Unknown
level: high
Massive Title Cleanup 2018-01-27 10:57:30 +01:00			`title: Fireball Archer Install`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 3d4aebe0-6d29-45b2-a8a4-3dfde586a26d`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`status: experimental`
Fixed description and title 2017-06-03 14:53:08 +02:00			`description: Detects Archer malware invocation via rundll32`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`author: Florian Roth`
			`date: 2017/06/03`
Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00			`references:`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`- https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/`
			`- https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100`
add tags to crime fireball rule 2019-03-13 10:10:12 +00:00			`tags:`
			`- attack.execution`
			`- attack.t1059`
fixed tag typo on rules 2019-03-13 10:22:38 +00:00			`- attack.defense_evasion`
add tags to crime fireball rule 2019-03-13 10:10:12 +00:00			`- attack.t1085`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`logsource:`
Converted to use the new process_creation data source 2019-03-09 20:57:59 +03:00			`category: process_creation`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`product: windows`
			`detection:`
			`selection:`
			`CommandLine: '\rundll32.exe ,InstallArcherSvc'`
Fixed description and title 2017-06-03 14:53:08 +02:00			`condition: selection`
Added field names to first rules 2017-09-12 23:54:04 +02:00			`fields:`
			`- CommandLine`
			`- ParentCommandLine`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`falsepositives:`
			`- Unknown`
			`level: high`