Detection rules › Sigma

Turla Group Lateral Movement

Status
test
Severity
critical
Log source
product windows, category process_creation
Author
Markus Neis
Source
github.com/SigmaHQ/sigma

Detects automated lateral movement by Turla group

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: Turla Group Lateral Movement
id: c601f20d-570a-4cde-a7d6-e17f99cb8e7f
status: test
description: Detects automated lateral movement by Turla group
references:
    - https://securelist.com/the-epic-turla-operation/65545/
author: Markus Neis
date: 2017-11-07
modified: 2022-10-09
tags:
    - attack.g0010
    - attack.execution
    - attack.t1059
    - attack.lateral-movement
    - attack.t1021.002
    - attack.discovery
    - attack.t1083
    - attack.t1135
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine:
            - 'net use \\\\%DomainController%\C$ "P@ssw0rd" *'
            - 'dir c:\\*.doc* /s'
            - 'dir %TEMP%\\*.exe'
    condition: selection
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    CommandLine:
        - 'net use \\\\%DomainController%\C$ "P@ssw0rd" *'
        - 'dir c:\\*.doc* /s'
        - 'dir %TEMP%\\*.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinewildcard
  • dir %TEMP%\\*.exe
  • dir c:\\*.doc* /s
  • net use \\\\%DomainController%\C$ "P@ssw0rd" *