detection.wiki

Detection rules › Sigma

DarkGate - Drop DarkGate Loader In C:\Temp Directory

Status
test
Severity
medium
Log source
product windows, category file_event
Author
Tomasz Dyduch, Josh Nickels
Source
github.com/SigmaHQ/sigma

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059 Command and Scripting Interpreter

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: DarkGate - Drop DarkGate Loader In C:\Temp Directory
id: df49c691-8026-48dd-94d3-4ba6a79102a8
status: test
description: Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
    - https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
author: Tomasz Dyduch, Josh Nickels
date: 2024-05-31
tags:
    - attack.execution
    - attack.t1059
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection_filename_suffix:
        TargetFilename|contains: ':\temp\'
        TargetFilename|endswith:
            - '.au3'
            - '\autoit3.exe'
    selection_image_suffix:
        Image|contains: ':\temp\'
        Image|endswith:
            - '.au3'
            - '\autoit3.exe'
    condition: 1 of selection_*
falsepositives:
    - Unlikely legitimate usage of AutoIT in temp folders.
level: medium

Stages and Predicates

Stage 0: condition

1 of selection_*

Stage 1: selection_filename_suffix

selection_filename_suffix:
    TargetFilename|contains: ':\temp\'
    TargetFilename|endswith:
        - '.au3'
        - '\autoit3.exe'

Stage 2: selection_image_suffix

selection_image_suffix:
    Image|contains: ':\temp\'
    Image|endswith:
        - '.au3'
        - '\autoit3.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • .au3
  • \autoit3.exe corpus 3 (sigma 3)
Imagematch
  • :\temp\ corpus 13 (sigma 13)
TargetFilenameends_with
  • .au3 corpus 2 (sigma 2)
  • \autoit3.exe corpus 2 (sigma 2)
TargetFilenamematch
  • :\temp\ corpus 5 (sigma 5)