Detection rules › Sigma
Greenbug Espionage Group Indicators
Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
| Stealth | T1036.005 Masquerading: Match Legitimate Resource Name or Location |
| Command & Control | T1105 Ingress Tool Transfer |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
title: Greenbug Espionage Group Indicators
id: 3711eee4-a808-4849-8a14-faf733da3612
status: test
description: Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec
references:
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia
author: Florian Roth (Nextron Systems)
date: 2020-05-20
modified: 2023-03-09
tags:
- attack.stealth
- attack.g0049
- attack.execution
- attack.t1059.001
- attack.command-and-control
- attack.t1105
- attack.t1036.005
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- ':\ProgramData\adobe\Adobe.exe'
- ':\ProgramData\oracle\local.exe'
- '\revshell.exe'
- '\infopagesbackup\ncat.exe'
- ':\ProgramData\comms\comms.exe'
selection_msf:
CommandLine|contains|all:
- '-ExecutionPolicy Bypass -File'
- '\msf.ps1'
selection_ncat:
CommandLine|contains|all:
- 'infopagesbackup'
- '\ncat'
- '-e cmd.exe'
selection_powershell:
CommandLine|contains:
- 'system.Data.SqlClient.SqlDataAdapter($cmd); [void]$da.fill'
- '-nop -w hidden -c $k=new-object'
- '[Net.CredentialCache]::DefaultCredentials;IEX '
- ' -nop -w hidden -c $m=new-object net.webclient;$m'
- '-noninteractive -executionpolicy bypass whoami'
- '-noninteractive -executionpolicy bypass netstat -a'
selection_other:
CommandLine|contains: 'L3NlcnZlcj1' # base64 encoded '/server='
condition: 1 of selection_*
falsepositives:
- Unlikely
level: critical
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_img
selection_img:
Image|endswith:
- ':\ProgramData\adobe\Adobe.exe'
- ':\ProgramData\oracle\local.exe'
- '\revshell.exe'
- '\infopagesbackup\ncat.exe'
- ':\ProgramData\comms\comms.exe'
Stage 2: selection_msf
selection_msf:
CommandLine|contains|all:
- '-ExecutionPolicy Bypass -File'
- '\msf.ps1'
Stage 3: selection_ncat
selection_ncat:
CommandLine|contains|all:
- 'infopagesbackup'
- '\ncat'
- '-e cmd.exe'
Stage 4: selection_powershell
selection_powershell:
CommandLine|contains:
- 'system.Data.SqlClient.SqlDataAdapter($cmd); [void]$da.fill'
- '-nop -w hidden -c $k=new-object'
- '[Net.CredentialCache]::DefaultCredentials;IEX '
- ' -nop -w hidden -c $m=new-object net.webclient;$m'
- '-noninteractive -executionpolicy bypass whoami'
- '-noninteractive -executionpolicy bypass netstat -a'
Stage 5: selection_other
selection_other:
CommandLine|contains: 'L3NlcnZlcj1'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|