Detection rules › Sigma
Potential COLDSTEEL Persistence Service DLL Creation
Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | No specific technique |
| Stealth | No specific technique |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 11: FileCreate |
Rule body
title: Potential COLDSTEEL Persistence Service DLL Creation
id: 1fea93a2-1524-4a3c-9828-3aa0c2414e27
status: test
description: Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
author: X__Junior (Nextron Systems)
date: 2023-04-30
tags:
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|startswith: 'C:\Users\'
TargetFilename|endswith: '\AppData\Roaming\newdev.dll'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
TargetFilename|startswith: 'C:\Users\'
TargetFilename|endswith: '\AppData\Roaming\newdev.dll'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with value:"\AppData\Roaming\newdev.dll" |
TargetFilename | starts_with |
| field:"TargetFilename" kind:starts_with value:"C:\Users\" |