Emerging Threathightest

Potential Devil Bait Malware Reconnaissance

Detects specific process behavior observed with Devil Bait samples

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems), NCSCCreated Mon May 15Updated Sun Oct 19e8954be4-b2b8-4961-be18-da1a5bda709c2021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_redirect:
        ParentImage|endswith: '\wscript.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains: '>>%APPDATA%\Microsoft\'
        CommandLine|endswith:
            - '.xml'
            - '.txt'
    selection_recon_cmd:
        - CommandLine|re: 'ipconfig\s+/all'
        - CommandLine|contains:
              # Taken from a6f9043627f8be2452153b5dbf6278e9b91763c3b5c2aea537a859e0c8c6b504
              # If you find samples using other commands please add them
              - 'dir'
              - 'systeminfo'
              - 'tasklist'
    condition: all of selection_*

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Techniques

T1218 · System Binary Proxy Execution

Other

detection.emerging-threats

Related Rules

DerivedDetectionmedium

Potentially Suspicious CMD Shell Output Redirect

Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

e8954be4-b2b8-4961-be18-da1a5bda709c

Status

test

Level

high

Type

Emerging Threat

Created

Mon May 15

Modified

Sun Oct 19

Author

Nasreddine Bencherchali (Nextron Systems), NCSC

Path

rules-emerging-threats/2021/Malware/Devil-Bait/proc_creation_win_malware_devil_bait_output_redirect.yml

Raw Tags

attack.defense-evasionattack.t1218detection.emerging-threats

View on GitHub