Emerging Threathightest

Potential Goofy Guineapig Backdoor Activity

Detects a specific broken command that was used by Goofy-Guineapig as described by the NCSC report.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
X__Junior (Nextron Systems)Created Sun May 14477a5ed3-a374-4282-9f3b-ed94e159a1082021
Emerging Threat
Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains: 'choice /t %d /d y /n >nul'
    condition: selection
False Positives
Unlikely

False positives are unlikely for most environments. High confidence detection.

MITRE ATT&CK

Other

detection.emerging-threats
Rule Metadata
Rule ID
477a5ed3-a374-4282-9f3b-ed94e159a108
Status
test
Level
high
Type
Emerging Threat
Created
Sun May 14
Path
rules-emerging-threats/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_broken_cmd.yml
Raw Tags
attack.executiondetection.emerging-threats
View on GitHub