rules/windows/process_creation/proc_creation_win_mal_adwind.yml

title: Adwind RAT / JRAT
id: 1fac1481-2dbc-48b2-9096-753c49b4ec71
status: experimental
description: Detects javaw.exe in AppData folder as used by Adwind / JRAT
references:
    - https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
    - https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
author: Florian Roth, Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
date: 2017/11/10
modified: 2021/09/19
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|contains|all:
            - '\AppData\Roaming\Oracle'
            - '\java'
            - '.exe '
        - CommandLine|contains|all:
            - 'cscript.exe'
            - 'Retrive'
            - '.vbs '
    condition: selection
level: high
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`title: Adwind RAT / JRAT`
$frack113$ split win_mal_adwind.yml 2021-09-19 10:12:03 +02:00			`id: 1fac1481-2dbc-48b2-9096-753c49b4ec71`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`status: experimental`
			`description: Detects javaw.exe in AppData folder as used by Adwind / JRAT`
			`references:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`- https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100`
			`- https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf`
Update win_mal_adwind.yml 2020-11-28 11:25:28 +01:00			`author: Florian Roth, Tom Ueltschi, Jonhnathan Ribeiro, oscd.community`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`date: 2017/11/10`
$frack113$ split win_mal_adwind.yml 2021-09-19 10:12:03 +02:00			`modified: 2021/09/19`
Added missing tags and some minor improvements 2019-03-05 23:25:49 +01:00			`tags:`
			`- attack.execution`
Further subtechnique updates 2020-06-17 11:31:40 -06:00			`- attack.t1059.005`
att&ck tags review: windows/process_creation part 3 2020-09-01 17:02:36 +00:00			`- attack.t1059.007`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`logsource:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`category: process_creation`
			`product: windows`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`detection:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`selection:`
Update win_mal_adwind.yml 2020-11-28 11:25:28 +01:00			`- CommandLine\|contains\|all:`
			`- '\AppData\Roaming\Oracle'`
			`- '\java'`
			`- '.exe '`
			`- CommandLine\|contains\|all:`
			`- 'cscript.exe'`
			`- 'Retrive'`
			`- '.vbs '`
$frack113$ split win_mal_adwind.yml 2021-09-19 10:12:03 +02:00			`condition: selection`
			`level: high`