Detection rules › Sigma

Potential COLDSTEEL Persistence Service DLL Creation

Status
test
Severity
high
Log source
category file_event, product windows
Author
X__Junior (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

MITRE ATT&CK coverage

TacticTechniques
PersistenceNo specific technique
StealthNo specific technique

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 11: FileCreate

Rule body

title: Potential COLDSTEEL Persistence Service DLL Creation
id: 1fea93a2-1524-4a3c-9828-3aa0c2414e27
status: test
description: Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
author: X__Junior (Nextron Systems)
date: 2023-04-30
tags:
    - attack.persistence
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|endswith: '\AppData\Roaming\newdev.dll'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetFilename|startswith: 'C:\Users\'
    TargetFilename|endswith: '\AppData\Roaming\newdev.dll'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetFilenameends_with
  • \AppData\Roaming\newdev.dll
field:"TargetFilename" kind:ends_with value:"\AppData\Roaming\newdev.dll"
TargetFilenamestarts_with
  • C:\Users\ corpus 13 (sigma 9, elastic 4)
field:"TargetFilename" kind:starts_with value:"C:\Users\"