detection.wiki

Detection rules › Sigma

Operation Wocao Activity - Security

Status
test
Severity
high
Log source
product windows, service security
Author
Florian Roth (Nextron Systems), frack113
Source
github.com/SigmaHQ/sigma

Detects activity mentioned in Operation Wocao report

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task, T1059.001 Command and Scripting Interpreter: PowerShell
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task
StealthT1027 Obfuscated Files or Information, T1036.004 Masquerading: Masquerade Task or Service
DiscoveryT1012 Query Registry

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4799A security-enabled local group membership was enumerated.

Rule body yaml

title: Operation Wocao Activity - Security
id: 74ad4314-482e-4c3e-b237-3f7ed3b9ca8d
status: test
description: Detects activity mentioned in Operation Wocao report
references:
    - https://web.archive.org/web/20200226212615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
    - https://web.archive.org/web/20200226212615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf
    - https://twitter.com/SBousseaden/status/1207671369963646976
author: Florian Roth (Nextron Systems), frack113
date: 2019-12-20
modified: 2022-11-27
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.discovery
    - attack.stealth
    - attack.t1012
    - attack.t1036.004
    - attack.t1027
    - attack.execution
    - attack.t1053.005
    - attack.t1059.001
    - detection.emerging-threats
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4799
        TargetUserName|startswith: 'Administr'
        CallerProcessName|endswith: '\checkadmin.exe'
    condition: selection
falsepositives:
    - Administrators that use checkadmin.exe tool to enumerate local administrators
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    EventID: 4799
    TargetUserName|startswith: 'Administr'
    CallerProcessName|endswith: '\checkadmin.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CallerProcessNameends_with
  • \checkadmin.exe
TargetUserNamestarts_with
  • Administr corpus 2 (sigma 2)