Potential BOINC Software Execution (UC-Berkeley Signature)

Status: test
Severity: informational
Log source: category process_creation, product windows
Author: Matt Anderson (Huntress)
Source: github.com/SigmaHQ/sigma

Detects the use of software that is related to the University of California, Berkeley via metadata information. This indicates it may be related to BOINC software and can be used maliciously if unauthorized.

Known false positives

This software can be used for legitimate purposes when installed intentionally.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1553` Subvert Trust Controls

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential BOINC Software Execution (UC-Berkeley Signature)
id: 0090b851-3543-42db-828c-02fee986ff0b
status: test
description: |
    Detects the use of software that is related to the University of California, Berkeley via metadata information.
    This indicates it may be related to BOINC software and can be used maliciously if unauthorized.
references:
    - https://boinc.berkeley.edu/
    - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
author: Matt Anderson (Huntress)
date: 2024-07-23
tags:
    - attack.execution
    - attack.defense-impairment
    - attack.t1553
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Description: 'University of California, Berkeley'
    condition: selection
falsepositives:
    - This software can be used for legitimate purposes when installed intentionally.
level: informational

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Description: 'University of California, Berkeley'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Description`	eq	`University of California, Berkeley`	`field:"Description" kind:eq value:"University of California, Berkeley"`