Potential COLDSTEEL Persistence Service DLL Load

Status: test
Severity: high
Log source: category image_load, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule body

title: Potential COLDSTEEL Persistence Service DLL Load
id: 1d7a57da-02e0-4f7f-92b1-c7b486ccfed5
status: test
description: |
    Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-02
tags:
    - attack.persistence
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Image|endswith: '\svchost.exe'
        ImageLoaded|endswith: '\AppData\Roaming\newdev.dll'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\svchost.exe'
    ImageLoaded|endswith: '\AppData\Roaming\newdev.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\svchost.exe` corpus 23 (sigma 22, kusto 1)	`field:"Image" kind:ends_with value:"\svchost.exe"`
`ImageLoaded`	ends_with	`\AppData\Roaming\newdev.dll`	`field:"ImageLoaded" kind:ends_with value:"\AppData\Roaming\newdev.dll"`