CodePage Modification Via MODE.COM To Russian Language

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Source: github.com/SigmaHQ/sigma

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

Known false positives

Russian speaking people changing the CodePage

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036` Masquerading

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: CodePage Modification Via MODE.COM To Russian Language
id: 12fbff88-16b5-4b42-9754-cd001a789fb3
related:
    - id: d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
      type: derived
status: test
description: |
    Detects a CodePage modification using the "mode.com" utility to Russian language.
    This behavior has been used by threat actors behind Dharma ransomware.
references:
    - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode
    - https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html
    - https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2024-01-17
tags:
    - attack.stealth
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    # VT Query: behavior:"mode con cp select=1251"
    # VT Query: behavior:"mode con cp select=866"
    selection_img:
        - Image|endswith: '\mode.com'
        - OriginalFileName: 'MODE.COM'
    selection_cli:
        CommandLine|contains|all:
            - ' con '
            - ' cp '
            - ' select='
        CommandLine|endswith:
            - '=1251' # ANSI Cyrillic; Cyrillic (Windows) - Observed ITW by Dharma ransomware
            - '=866' # OEM Russian; Cyrillic (DOS) - Observed ITW by other malware
    condition: all of selection_*
falsepositives:
    - Russian speaking people changing the CodePage
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\mode.com'
    - OriginalFileName: 'MODE.COM'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - ' con '
        - ' cp '
        - ' select='
    CommandLine|endswith:
        - '=1251'
        - '=866'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`=1251` `=866`	`field:"CommandLine" kind:ends_with`
`CommandLine`	match	`con` corpus 2 (sigma 2) `cp` corpus 8 (sigma 6, elastic 1, chronicle 1) `select=` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\mode.com` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\mode.com"`
`OriginalFileName`	eq	`MODE.COM` corpus 2 (sigma 2)	`field:"OriginalFileName" kind:eq value:"MODE.COM"`