Potential Proxy Malware via AutoRun Key (PowerShell)

id: '24645.45567'
title: Potential Proxy Malware via AutoRun Key
description: The Windows Registry Run keys can be abused to establish persistence
  for malware known as SystemBC (aka Coroxy or DroxiDat), which functions as a proxy,
  bot, backdoor, and RAT. Threat actors utilize this method to maintain continuous
  access to a compromised system, enabling them to gather information, execute commands,
  and deploy additional malware. SystemBC has been observed modifying AutoRun keys
  with a value of socks5. This use case detects modifications to registry keys containing
  the path \SOFTWARE\Microsoft\Windows\CurrentVersion\Run including the value "socks5".
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "socks5"
  | table _time, host, user signature_id, process, process_*, user, parent_process_path
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
- T1547.001
data_category:
- PowerShell logs
references:
- https://rexorvc0.com/2023/11/12/Swiss-Knife-SystemBC-Coroxy/