rules/windows/process_creation/proc_creation_win_malware_fireball.yml

title: Fireball Archer Install
id: 3d4aebe0-6d29-45b2-a8a4-3dfde586a26d
status: test
description: Detects Archer malware invocation via rundll32
references:
    - https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/
    - https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100
author: Florian Roth (Nextron Systems)
date: 2017/06/03
modified: 2021/11/27
tags:
    - attack.execution
    - attack.defense_evasion
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'rundll32.exe'
            - 'InstallArcherSvc'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Unknown
level: high
Massive Title Cleanup 2018-01-27 10:57:30 +01:00			`title: Fireball Archer Install`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 3d4aebe0-6d29-45b2-a8a4-3dfde586a26d`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Fixed description and title 2017-06-03 14:53:08 +02:00			`description: Detects Archer malware invocation via rundll32`
Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00			`references:`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`- https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/`
			`- https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100`
chore: add nextron authors tag 2023-02-01 11:14:59 +01:00			`author: Florian Roth (Nextron Systems)`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`date: 2017/06/03`
			`modified: 2021/11/27`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`tags:`
			`- attack.execution`
			`- attack.defense_evasion`
			`- attack.t1218.011`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`logsource:`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`category: process_creation`
			`product: windows`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`detection:`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`selection:`
			`CommandLine\|contains\|all:`
			`- 'rundll32.exe'`
			`- 'InstallArcherSvc'`
			`condition: selection`
Added field names to first rules 2017-09-12 23:54:04 +02:00			`fields:`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`- CommandLine`
			`- ParentCommandLine`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`falsepositives:`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`- Unknown`
Fireball Sigma Rule 2017-06-03 14:48:47 +02:00			`level: high`