Emerging Threatcriticaltest

EvilNum APT Golden Chickens Deployment Via OCX Files

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Fri Jul 10Updated Thu Mar 098acf3cfa-1e8c-4099-83de-a0c4038e18f02020

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains|all:
            - 'regsvr32'
            - '/s'
            - '/i'
            - '\AppData\Roaming\'
            - '.ocx'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Sub-techniques

T1218.011 · Rundll32

Other

detection.emerging-threats

Rule Metadata

Rule ID

8acf3cfa-1e8c-4099-83de-a0c4038e18f0

Status

test

Level

critical

Type

Emerging Threat

Created

Fri Jul 10

Modified

Thu Mar 09

Author

Florian Roth (Nextron Systems)

Path

rules-emerging-threats/2020/TA/Evilnum/proc_creation_win_apt_evilnum_jul20.yml

Raw Tags

attack.defense-evasionattack.t1218.011detection.emerging-threats

View on GitHub