Emerging Threathightest

Ursnif Redirection Of Discovery Commands

Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

kostastsaleCreated Sun Jul 167aaa5739-12fc-41aa-b98b-23ec27d42bdf2023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - '/C '
            - ' >> *\AppData\local\temp\*.bin'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics

TA0002 · Execution

Techniques

T1059 · Command and Scripting Interpreter

Other

detection.emerging-threats

Rule Metadata

Rule ID

7aaa5739-12fc-41aa-b98b-23ec27d42bdf

Status

test

Level

high

Type

Emerging Threat

Created

Sun Jul 16

Author

kostastsale

Path

rules-emerging-threats/2023/Malware/Ursnif/proc_creation_win_malware_ursnif_cmd_redirection.yml

Raw Tags

attack.executionattack.t1059detection.emerging-threats

View on GitHub