Possible impact of 'SMOKEDHAM backdoor' with MSDTC service privilege escalation via command line

Status: production
Severity: medium
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

This rule detects activity related to 'SMOKEDHAM backdoor' which manipulate the default running service accounf of the MSDTC service in order to DLL side-load a malicious binary.

Known false positives

None (administrators should not change the service account for MSDTC service)

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1574.001` Hijack Execution Flow: DLL
Privilege Escalation	`T1543.003` Create or Modify System Process: Windows Service
Stealth	`T1574.001` Hijack Execution Flow: DLL

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Possible impact of 'SMOKEDHAM backdoor' with MSDTC service privilege escalation via command line
id: 726e148b-a091-4786-8f4e-3066d69608e1
description: This rule detects activity related to 'SMOKEDHAM backdoor' which manipulate the default running service accounf of the MSDTC service in order to DLL side-load a malicious binary.
references:
- https://medium.com/trac-labs/who-ordered-the-smokedham-backdoor-delicacies-in-the-wild-87f51e2e5bd2
tags:
- attack.privilege_escalation
- attack.t1574.002 # Hijack Execution Flow: DLL Side-Loading 
- attack.privilege_escalation
- attack.t1543.003 # Create or Modify System Process: Windows Service 
author: mdecrevoisier
status: production
logsource:
  product: windows
  category: process_creation
detection:
    selection_img:
        - Image|endswith: '\sc.exe'
        - OriginalFileName: 'sc.exe'
    selection_cli:
        CommandLine|contains:
            - 'config'
            - 'msdtc'
            - 'LocalSystem'
    condition: all of selection_*
falsepositives:
- None  (administrators should not change the service account for MSDTC service)
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\sc.exe'
    - OriginalFileName: 'sc.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains:
        - 'config'
        - 'msdtc'
        - 'LocalSystem'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`LocalSystem` `config` corpus 16 (sigma 15, splunk 1) `msdtc` corpus 3 (sigma 3)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\sc.exe` corpus 30 (sigma 30)	`field:"Image" kind:ends_with value:"\sc.exe"`
`OriginalFileName`	eq	`sc.exe` corpus 30 (sigma 12, splunk 10, elastic 8)	`field:"OriginalFileName" kind:eq value:"sc.exe"`