detection.wiki

Detection rules › Sigma

Potential APT FIN7 Exploitation Activity

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Alex Walston (@4ayymm)
Source
github.com/SigmaHQ/sigma

Detects potential APT FIN7 exploitation activity as reported by Google. In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell, T1059.003 Command and Scripting Interpreter: Windows Command Shell

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Potential APT FIN7 Exploitation Activity
id: 6676896b-2cce-422d-82af-5a1abe65e241
status: test
description: |
    Detects potential APT FIN7 exploitation activity as reported by Google.
    In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
author: Alex Walston (@4ayymm)
date: 2024-07-29
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_notepad_plus:
        ParentImage|endswith: '\notepad++.exe'
        Image|endswith: '\cmd.exe'
    selection_rdpinit:
        ParentImage|endswith: '\rdpinit.exe'
        Image|endswith: '\notepad++.exe'
    condition: 1 of selection_*
falsepositives:
    - Notepad++ can legitimately spawn cmd (Open Containing Folder in CMD)
level: medium

Stages and Predicates

Stage 0: condition

1 of selection_*

Stage 1: selection_notepad_plus

selection_notepad_plus:
    ParentImage|endswith: '\notepad++.exe'
    Image|endswith: '\cmd.exe'

Stage 2: selection_rdpinit

selection_rdpinit:
    ParentImage|endswith: '\rdpinit.exe'
    Image|endswith: '\notepad++.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \notepad++.exe
ParentImageends_with
  • \notepad++.exe
  • \rdpinit.exe