mediumtestEmerging Threat
DarkGate - Drop DarkGate Loader In C:\Temp Directory
Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
windowsfile_event
2024-05-31
Emerging Threats
Malware2024, 2023
DarkGate
4Rules
6References
2Folders
2024-05-31Latest
Summary
DarkGate is tracked here as a malware family or toolset with 4 Sigma detections spanning 2024, 2023. Coverage centers on windows / file_event, windows / process_creation.
Related Detections
Search this threathightestEmerging Threat
DarkGate - Autoit3.EXE Execution Parameters
Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.
windowsprocess_creation
2023-10-15
mediumtestEmerging Threat
DarkGate - Autoit3.EXE File Creation By Uncommon Process
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
windowsfile_event
2023-10-15
hightestEmerging Threat
DarkGate - User Created Via Net.EXE
Detects creation of local users via the net.exe command with the name of "DarkGate"
windowsprocess_creation
2023-10-15
References