Emerging Threathightest

Malware Shellcode in Verclsid Target Process

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
John Lambert (tech), Florian Roth (Nextron Systems)Created Sat Mar 04Updated Sat Nov 27b7967e22-3d7e-409b-9ed5-cdae3f9243a12017
Emerging Threat
Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source
WindowsProcess Access
ProductWindows← raw: windows
CategoryProcess Access← raw: process_access

Events when a process opens a handle to another process, commonly used for credential dumping via LSASS.

Definition

Requirements: The following config is required to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>

Detection Logic
Detection Logic3 selectors
detection:
    selection_target:
        TargetImage|endswith: '\verclsid.exe'
        GrantedAccess: '0x1FFFFF'
    selection_calltrace_1:
        CallTrace|contains|all:
            - '|UNKNOWN('
            - 'VBE7.DLL'
    selection_calltrace_2:
        SourceImage|contains: '\Microsoft Office\'
        CallTrace|contains: '|UNKNOWN'
    condition: selection_target and 1 of selection_calltrace_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

MITRE ATT&CK
Rule Metadata
Rule ID
b7967e22-3d7e-409b-9ed5-cdae3f9243a1
Status
test
Level
high
Type
Emerging Threat
Created
Sat Mar 04
Modified
Sat Nov 27
Path
rules-emerging-threats/2017/Malware/Hancitor/proc_access_win_malware_verclsid_shellcode.yml
Raw Tags
attack.defense-evasionattack.privilege-escalationattack.t1055detection.emerging-threats
View on GitHub