Detection rules › Sigma
Potential APT10 Cloud Hopper Activity
Detects potential process and execution activity related to APT10 Cloud Hopper operation
Known false positives
- Unlikely
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: Potential APT10 Cloud Hopper Activity
id: 966e4016-627f-44f7-8341-f394905c361f
status: test
description: Detects potential process and execution activity related to APT10 Cloud Hopper operation
references:
- https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
author: Florian Roth (Nextron Systems)
date: 2017-04-07
modified: 2023-03-08
tags:
- attack.execution
- attack.g0045
- attack.t1059.005
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_cscript:
Image|endswith: '\cscript.exe'
CommandLine|contains: '.vbs /shell '
selection_csvde:
CommandLine|contains|all:
- 'csvde -f C:\windows\web\'
- '.log'
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_cscript
selection_cscript:
Image|endswith: '\cscript.exe'
CommandLine|contains: '.vbs /shell '
Stage 2: selection_csvde
selection_csvde:
CommandLine|contains|all:
- 'csvde -f C:\windows\web\'
- '.log'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\cscript.exe" |