feat: Add new rule for Creative Cloud node abuse

2022-04-07 09:08:21 +02:00
parent 026490921c
commit 3cddcc906d
1 changed files with 28 additions and 0 deletions
@@ -0,0 +1,28 @@
+title: Node Process Executions
+id: df1f26d3-bea7-4700-9ea2-ad3e990cf90e
+status: experimental
+description: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
+references:
+    - https://twitter.com/mttaggart/status/1511804863293784064
+author: Max Altgelt
+date: 2022/04/06
+tags:
+    - attack.defense_evasion
+    - attack.t1127
+    - attack.t1059.007
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        Image|endswith: '\Adobe Creative Cloud Experience\libs\node.exe'
+    filter:
+        CommandLine|contains: 'Adobe Creative Cloud Experience\js' # Folder where Creative Cloud's JS resources are located
+    condition: selection and not filter
+fields:
+    - Image
+    - CommandLine
+    - ParentCommandLine
+falsepositives:
+    - Unknown
+level: medium