COLDSTEEL RAT Cleanup Command Execution

Status: test
Severity: critical
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: COLDSTEEL RAT Cleanup Command Execution
id: 88516f06-ebe0-47ad-858e-ae9fd060ddea
status: test
description: Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-30
tags:
    - attack.persistence
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\svchost.exe'
        ParentCommandLine|contains:
            - ' -k msupdate'
            - ' -k msupdate2'
            - ' -k alg'
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - 'UpdateDriverForPlugAndPlayDevicesW'
            - 'ServiceMain'
            - 'DiUninstallDevice'
    condition: selection
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ParentImage|endswith: '\svchost.exe'
    ParentCommandLine|contains:
        - ' -k msupdate'
        - ' -k msupdate2'
        - ' -k alg'
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
        - 'UpdateDriverForPlugAndPlayDevicesW'
        - 'ServiceMain'
        - 'DiUninstallDevice'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`DiUninstallDevice` `ServiceMain` `UpdateDriverForPlugAndPlayDevicesW`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\rundll32.exe` corpus 94 (sigma 94)	`field:"Image" kind:ends_with value:"\rundll32.exe"`
`ParentCommandLine`	match	`-k alg` `-k msupdate` `-k msupdate2`	`field:"ParentCommandLine" kind:match`
`ParentImage`	ends_with	`\svchost.exe` corpus 15 (sigma 14, kusto 1)	`field:"ParentImage" kind:ends_with value:"\svchost.exe"`