Potential Devil Bait Related Indicator

Status: test
Severity: high
Log source: category file_event, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of ".xml" and ".txt" files in folders of the "\AppData\Roaming\Microsoft" directory by uncommon processes. This behavior was seen common across different Devil Bait samples and stages as described by the NCSC

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Potential Devil Bait Related Indicator
id: 93d5f1b4-36df-45ed-8680-f66f242b8415
status: test
description: Detects the creation of ".xml" and ".txt" files in folders of the "\AppData\Roaming\Microsoft" directory by uncommon processes. This behavior was seen common across different Devil Bait samples and stages as described by the NCSC
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-15
tags:
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith:
            - '\schtasks.exe'
            - '\wscript.exe'
            - '\mshta.exe'
        # Example folders used by the samples include:
        #   - %AppData%\Microsoft\Network\
        #   - %AppData%\Microsoft\Office\
        TargetFilename|contains: '\AppData\Roaming\Microsoft\'
        TargetFilename|endswith:
            - '.txt'
            - '.xml'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith:
        - '\schtasks.exe'
        - '\wscript.exe'
        - '\mshta.exe'
    TargetFilename|contains: '\AppData\Roaming\Microsoft\'
    TargetFilename|endswith:
        - '.txt'
        - '.xml'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\mshta.exe` corpus 66 (sigma 66) `\schtasks.exe` corpus 55 (sigma 55) `\wscript.exe` corpus 74 (sigma 74)	`field:"Image" kind:ends_with`
`TargetFilename`	ends_with	`.txt` corpus 3 (sigma 3) `.xml` corpus 2 (sigma 2)	`field:"TargetFilename" kind:ends_with`
`TargetFilename`	match	`\AppData\Roaming\Microsoft\`	`field:"TargetFilename" kind:match value:"\AppData\Roaming\Microsoft\"`