Detection rules › Sigma

Blue Mockingbird

Status
test
Severity
high
Log source
category process_creation, product windows
Author
Trent Liffick (@tliffick)
Source
github.com/SigmaHQ/sigma

Attempts to detect system changes made by Blue Mockingbird

MITRE ATT&CK coverage

Telemetry coverage

Rule body

title: Blue Mockingbird
id: c3198a27-23a0-4c2c-af19-e5328d49680e
related:
    - id: ce239692-aa94-41b3-b32f-9cab259c96ea
      type: merged
status: test
description: Attempts to detect system changes made by Blue Mockingbird
references:
    - https://redcanary.com/blog/blue-mockingbird-cryptominer/
author: Trent Liffick (@tliffick)
date: 2020-05-14
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - attack.t1047
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    sc_cmd:
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'sc config'
            - 'wercplsupporte.dll'
    wmic_cmd:
        Image|endswith: '\wmic.exe'
        CommandLine|endswith: 'COR_PROFILER'
    condition: sc_cmd or wmic_cmd
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

sc_cmd or wmic_cmd

Stage 1: sc_cmd

sc_cmd:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:
        - 'sc config'
        - 'wercplsupporte.dll'

Stage 2: wmic_cmd

wmic_cmd:
    Image|endswith: '\wmic.exe'
    CommandLine|endswith: 'COR_PROFILER'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLineends_with
  • COR_PROFILER
field:"CommandLine" kind:ends_with value:"COR_PROFILER"
CommandLinematch
  • sc config
  • wercplsupporte.dll
field:"CommandLine" kind:match
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \wmic.exe corpus 62 (sigma 62)
field:"Image" kind:ends_with