DarkGate - Drop DarkGate Loader In C:\Temp Directory

Status: test
Severity: medium
Log source: category file_event, product windows
Author: Tomasz Dyduch, Josh Nickels
Source: github.com/SigmaHQ/sigma

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

Known false positives

Unlikely legitimate usage of AutoIT in temp folders.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: DarkGate - Drop DarkGate Loader In C:\Temp Directory
id: df49c691-8026-48dd-94d3-4ba6a79102a8
status: test
description: Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
    - https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
author: Tomasz Dyduch, Josh Nickels
date: 2024-05-31
tags:
    - attack.execution
    - attack.t1059
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection_filename_suffix:
        TargetFilename|contains: ':\temp\'
        TargetFilename|endswith:
            - '.au3'
            - '\autoit3.exe'
    selection_image_suffix:
        Image|contains: ':\temp\'
        Image|endswith:
            - '.au3'
            - '\autoit3.exe'
    condition: 1 of selection_*
falsepositives:
    - Unlikely legitimate usage of AutoIT in temp folders.
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_filename_suffix`

selection_filename_suffix:
    TargetFilename|contains: ':\temp\'
    TargetFilename|endswith:
        - '.au3'
        - '\autoit3.exe'

Stage 2: `selection_image_suffix`

selection_image_suffix:
    Image|contains: ':\temp\'
    Image|endswith:
        - '.au3'
        - '\autoit3.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`.au3` `\autoit3.exe` corpus 3 (sigma 3)	`field:"Image" kind:ends_with`
`Image`	match	`:\temp\` corpus 11 (sigma 11)	`field:"Image" kind:match value:":\temp\"`
`TargetFilename`	ends_with	`.au3` corpus 2 (sigma 2) `\autoit3.exe` corpus 2 (sigma 2)	`field:"TargetFilename" kind:ends_with`
`TargetFilename`	match	`:\temp\` corpus 5 (sigma 5)	`field:"TargetFilename" kind:match value:":\temp\"`

DarkGate - Drop DarkGate Loader In C:\Temp Directory

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_filename_suffix

Stage 2: selection_image_suffix

Indicators

Stage 0: `condition`

Stage 1: `selection_filename_suffix`

Stage 2: `selection_image_suffix`