rules/windows/process_creation/proc_creation_win_apt_elise.yml

title: Elise Backdoor
id: e507feb7-5f73-4ef6-a970-91bb6f6d744f
status: test
description: Detects Elise backdoor acitivty as used by APT32
author: Florian Roth
references:
  - https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting
date: 2018/01/31
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    Image: 'C:\Windows\SysWOW64\cmd.exe'
    CommandLine|contains: '\Windows\Caches\NavShExt.dll '
  selection2:
    CommandLine|endswith: '\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll,Setting'
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
tags:
  - attack.g0030
  - attack.g0050
  - attack.s0081
  - attack.execution
  - attack.t1059.003
Rule: APT32 Elise 2018-01-31 23:11:37 +01:00			`title: Elise Backdoor`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: e507feb7-5f73-4ef6-a970-91bb6f6d744f`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`description: Detects Elise backdoor acitivty as used by APT32`
Rule: APT32 Elise 2018-01-31 23:11:37 +01:00			`author: Florian Roth`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`references:`
			`- https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting`
Rule: APT32 Elise 2018-01-31 23:11:37 +01:00			`date: 2018/01/31`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`modified: 2021/11/27`
Changed Elise backdoor rule 2018-02-25 17:25:04 +01:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: process_creation`
			`product: windows`
Rule: APT32 Elise 2018-01-31 23:11:37 +01:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection1:`
			`Image: 'C:\Windows\SysWOW64\cmd.exe'`
			`CommandLine\|contains: '\Windows\Caches\NavShExt.dll '`
			`selection2:`
			`CommandLine\|endswith: '\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll,Setting'`
refactor: change all " of them" expressions 2022-01-11 10:59:57 +01:00			`condition: 1 of selection*`
Rule: APT32 Elise 2018-01-31 23:11:37 +01:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Unknown`
Rule: APT32 Elise 2018-01-31 23:11:37 +01:00			`level: critical`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`tags:`
			`- attack.g0030`
			`- attack.g0050`
			`- attack.s0081`
			`- attack.execution`
			`- attack.t1059.003`