rules/windows/process_creation/proc_creation_win_apt_empiremonkey.yml

title: Empire Monkey
id: 10152a7b-b566-438f-a33c-390b607d1c8d
status: test
description: Detects EmpireMonkey APT reported Activity
author: Markus Neis
references:
  - https://app.any.run/tasks/a4107649-8cb0-41af-ad75-113152d4d57b
date: 2019/04/02
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_cutil:
    CommandLine|endswith: '/i:%APPDATA%\logs.txt scrobj.dll'
    Image|endswith: '\cutil.exe'
  selection_regsvr32:
    CommandLine|endswith: '/i:%APPDATA%\logs.txt scrobj.dll'
    Description: 'Microsoft(C) Registerserver'
  condition: 1 of selection*
falsepositives:
  - Very Unlikely
level: critical
tags:
  - attack.defense_evasion
  - attack.t1218.010
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`title: Empire Monkey`
			`id: 10152a7b-b566-438f-a33c-390b607d1c8d`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`description: Detects EmpireMonkey APT reported Activity`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`author: Markus Neis`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`references:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- https://app.any.run/tasks/a4107649-8cb0-41af-ad75-113152d4d57b`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`date: 2019/04/02`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`modified: 2021/11/27`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: process_creation`
			`product: windows`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection_cutil:`
			`CommandLine\|endswith: '/i:%APPDATA%\logs.txt scrobj.dll'`
			`Image\|endswith: '\cutil.exe'`
			`selection_regsvr32:`
			`CommandLine\|endswith: '/i:%APPDATA%\logs.txt scrobj.dll'`
			`Description: 'Microsoft(C) Registerserver'`
refactor: change all " of them" expressions 2022-01-11 10:59:57 +01:00			`condition: 1 of selection*`
$frack113$ Update global id 2021-09-03 06:50:00 +02:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Very Unlikely`
			`level: critical`
			`tags:`
			`- attack.defense_evasion`
			`- attack.t1218.010`