Emerging Threathightest
Potential EmpireMonkey Activity
Detects potential EmpireMonkey APT activity
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Markus Neis, Nasreddine Bencherchali (Nextron Systems)Created Tue Apr 02Updated Thu Mar 0910152a7b-b566-438f-a33c-390b607d1c8d2019
Emerging Threat
Active Threat
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic1 selector
detection:
selection:
CommandLine|contains|all:
- '/e:jscript' # This is a guess since the report doesn't mention the method of execution. This assumes that it is achieved via specifying the execution engine
- '\Local\Temp\Errors.bat'
condition: selectionFalse Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
MITRE ATT&CK
Rule Metadata
Rule ID
10152a7b-b566-438f-a33c-390b607d1c8d
Status
test
Level
high
Type
Emerging Threat
Created
Tue Apr 02
Modified
Thu Mar 09
Path
rules-emerging-threats/2019/TA/EmpireMonkey/proc_creation_win_apt_empiremonkey.yml
Raw Tags
attack.defense-evasionattack.t1218.010detection.emerging-threats