Potential PlugX Registry Modification

[rule]
description = """
Identifies registry modification that matches on PlugX Trojan known registry configuration patterns such as C&C version,
Run key persistence value and internet status on the victim machine. PlugX is a known RAT (Remote Access Trojan) malware
family that is around since 2008 and is used as a backdoor to control the victim's machine fully.
"""
id = "7a201712-9f3c-4f40-b4fc-2418a44b8ecb"
license = "Elastic License v2"
name = "Potential PlugX Registry Modification"
os_list = ["windows"]
reference = [
    "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong",
    "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/",
    "https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx",
]
version = "1.0.28"

query = '''
registry where

  /* PlugX store C&C server version in ms-pu sub values */
 registry.path : ("HK*\\Software\\CLASSES\\ms-pu\\PROXY*", "HK*\\Software\\CLASSES\\ms-pu\\CLSID*") or

  /* PlugX Persist via Run key with specific program args */
 (registry.path : "HK*\\CurrentVersion\\Run\\*" and
  not process.executable : ("?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\regedit.exe") and
  (registry.data.strings regex ".+exe. [0-9]{2,3}" or registry.data.strings : ("*.exe? -app", "*.exe? -net"))) or

  /* PlugX store internet status in Version value */
  (registry.path : "HK*\\System\\*ControlSet*\\Control\\Network\\Version" and registry.data.strings : "1")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"