Rule: Carbon Paper Framework Service (Turla)

https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
2017-03-31 19:25:41 +02:00
parent 919a04666c
commit 2657ff7db8
1 changed files with 17 additions and 0 deletions
@@ -0,0 +1,17 @@
+title: Turla Service Install
+description: 'This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET' 
+reference: https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
+logsource:
+    product: windows
+    service: system
+detection:
+    selection:
+        EventID: 7045
+        ServiceName:
+            - 'srservice'
+            - 'ipvpn'
+            - 'hkmsvc' 
+    condition: selection
+falsepositives:
+    - Unknown
+level: high