Malware Shellcode in Verclsid Target Process

Status: test
Severity: high
Log source: category process_access, product windows
Author: John Lambert (tech), Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1055` Process Injection
Stealth	`T1055` Process Injection

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 10: ProcessAccess

Rule body

title: Malware Shellcode in Verclsid Target Process
id: b7967e22-3d7e-409b-9ed5-cdae3f9243a1
status: test
description: Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro
references:
    - https://twitter.com/JohnLaTwC/status/837743453039534080
author: John Lambert (tech), Florian Roth (Nextron Systems)
date: 2017-03-04
modified: 2021-11-27
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - detection.emerging-threats
logsource:
    category: process_access
    product: windows
    definition: 'Requirements: The following config is required to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
detection:
    selection_target:
        TargetImage|endswith: '\verclsid.exe'
        GrantedAccess: '0x1FFFFF'
    selection_calltrace_1:
        CallTrace|contains|all:
            - '|UNKNOWN('
            - 'VBE7.DLL'
    selection_calltrace_2:
        SourceImage|contains: '\Microsoft Office\'
        CallTrace|contains: '|UNKNOWN'
    condition: selection_target and 1 of selection_calltrace_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection_target and 1 of selection_calltrace_*

Stage 1: `selection_target`

selection_target:
    TargetImage|endswith: '\verclsid.exe'
    GrantedAccess: '0x1FFFFF'

Stage 2: `selection_calltrace_1`

selection_calltrace_1:
    CallTrace|contains|all:
        - '|UNKNOWN('
        - 'VBE7.DLL'

Stage 3: `selection_calltrace_2`

selection_calltrace_2:
    SourceImage|contains: '\Microsoft Office\'
    CallTrace|contains: '|UNKNOWN'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CallTrace`	match	`VBE7.DLL` `\|UNKNOWN` `\|UNKNOWN(` corpus 2 (sigma 2)	`field:"CallTrace" kind:match`
`GrantedAccess`	eq	`0x1FFFFF` corpus 9 (sigma 7, splunk 1, kusto 1)	`field:"GrantedAccess" kind:eq value:"0x1FFFFF"`
`SourceImage`	match	`\Microsoft Office\`	`field:"SourceImage" kind:match value:"\Microsoft Office\"`
`TargetImage`	ends_with	`\verclsid.exe`	`field:"TargetImage" kind:ends_with value:"\verclsid.exe"`

Malware Shellcode in Verclsid Target Process

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_target

Stage 2: selection_calltrace_1

Stage 3: selection_calltrace_2

Indicators

Stage 0: `condition`

Stage 1: `selection_target`

Stage 2: `selection_calltrace_1`

Stage 3: `selection_calltrace_2`