Deimos Component Execution

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter
Collection	`T1005` Data from Local System
Exfiltration	`T1020` Automated Exfiltration

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceEvents` action `AmsiScriptContent`: AMSI script content captured

Rule body

id: c25a8cd4-5b4a-45a8-9ba0-3b753a652f6b
name: Deimos Component Execution
description: |
  Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - Collection
  - Exfiltration
relevantTechniques:
  - T1059
  - T1005
  - T1020
tags:
  - SolarMarker
  - Jupyter
  - Ransomware
query: |
  DeviceEvents   
  | where InitiatingProcessFileName =~ "powershell.exe"
  | where ActionType == "AmsiScriptContent"
  | where AdditionalFields endswith '[mArS.deiMos]::inteRaCt()"}'
  | project InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, AdditionalFields, DeviceName
  | extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
  | extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

DeviceEvents

Stage 2: `where`

| where InitiatingProcessFileName =~ "powershell.exe"

Stage 3: `where`

| where ActionType == "AmsiScriptContent"

Stage 4: `where`

| where AdditionalFields endswith '[mArS.deiMos]::inteRaCt()"}'

Stage 5: `project`

| project InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, AdditionalFields, DeviceName

Stage 6: `extend`

| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)

HostName =

ifDeviceName has "."substring(DeviceName, 0, indexof(DeviceName, '.'))

elseDeviceName

Stage 7: `extend`

| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")

DnsDomain =

ifDeviceName has "."substring(DeviceName, (indexof(DeviceName, '.') + 1))

else""

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`AmsiScriptContent`	`field:"ActionType" kind:eq value:"AmsiScriptContent"`
`AdditionalFields`	ends_with	`[mArS.deiMos]::inteRaCt()"}`	`field:"AdditionalFields" kind:ends_with`
`InitiatingProcessFileName`	eq	`powershell.exe` corpus 39 (elastic 36, kusto 2, splunk 1)	`field:"parent_process_name" kind:eq value:"powershell.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActionType`	`project`
`AdditionalFields`	`project`
`DeviceName`	`project`
`InitiatingProcessCommandLine`	`project`
`InitiatingProcessFileName`	`project`
`InitiatingProcessParentFileName`	`project`
`HostName`	`extend`
`DnsDomain`	`extend`

Deimos Component Execution

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: project

Stage 6: extend

Stage 7: extend