Potential Proxy Malware via AutoRun Key (Windows Event Log)

id: '24645.45565'
title: Potential Proxy Malware via AutoRun Key
description: The Windows Registry Run keys can be abused to establish persistence
  for malware known as SystemBC (aka Coroxy or DroxiDat), which functions as a proxy,
  bot, backdoor, and RAT. Threat actors utilize this method to maintain continuous
  access to a compromised system, enabling them to gather information, execute commands,
  and deploy additional malware. SystemBC has been observed modifying AutoRun keys
  with a value of socks5. This use case detects modifications to registry keys containing
  the path \SOFTWARE\Microsoft\Windows\CurrentVersion\Run including the value "socks5".
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "socks5" | table _time, host, user signature_id, process, process_*, user, parent_process_path
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
- T1547.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://rexorvc0.com/2023/11/12/Swiss-Knife-SystemBC-Coroxy/