Detectionhighstable
Suspicious Unsigned Thor Scanner Execution
Detects loading and execution of an unsigned thor scanner binary.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Sun Oct 29ea5c131b-380d-49f9-aeb3-920694da4d4bwindows
Log Source
WindowsImage Load (DLL)
ProductWindows← raw: windows
CategoryImage Load (DLL)← raw: image_load
Detection Logic
Detection Logic2 selectors
detection:
selection:
Image|endswith:
- '\thor.exe'
- '\thor64.exe'
ImageLoaded|endswith:
- '\thor.exe'
- '\thor64.exe'
filter_main:
Signed: 'true'
SignatureStatus: 'valid'
Signature: 'Nextron Systems GmbH'
condition: selection and not filter_mainFalse Positives
Other legitimate binaries named "thor.exe" that aren't published by Nextron Systems
References
1
Resolving title…
Internal ResearchMITRE ATT&CK
Rule Metadata
Rule ID
ea5c131b-380d-49f9-aeb3-920694da4d4b
Status
stable
Level
high
Type
Detection
Created
Sun Oct 29
Path
rules/windows/image_load/image_load_thor_unsigned_execution.yml
Raw Tags
attack.privilege-escalationattack.persistenceattack.defense-evasionattack.t1574.001