OilRig APT Schedule Task Persistence - System
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
detection:
selection:
Provider_Name: 'Service Control Manager'
EventID: 7045
ServiceName:
- 'SC Scheduled Scan'
- 'UpdatMachine'
condition: selectionFalse positives are unlikely for most environments. High confidence detection.
Tactics
Techniques
Groups
Software
Other
OilRig APT Schedule Task Persistence - Security
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Detects similar activity. Both rules may fire on overlapping events.
OilRig APT Registry Persistence
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
Detects similar activity. Both rules may fire on overlapping events.
OilRig APT Activity
Detects OilRig activity as reported by Nyotron in their March 2018 report
Detects similar activity. Both rules may fire on overlapping events.