Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
1 contributor

Users who have contributed to this file

31 lines (31 sloc) 1.11 KB
title: Emotet Process Creation
id: d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18
status: experimental
description: Detects all Emotet like process executions that are not covered by the more generic rules
author: Florian Roth
date: 2019/09/30
modified: 2019/10/16
references:
- https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/
- https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/
- https://app.any.run/tasks/97f875e8-0e08-4328-815f-055e971ba754/
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine:
- '* -e* PAA*'
- '*JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ*' # $env:userprofile
- '*QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA*' # $env:userprofile
- '*kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA*' # $env:userprofile
- '*IgAoACcAKgAnACkAOwAkA*' # "('*');$
- '*IAKAAnACoAJwApADsAJA*' # "('*');$
- '*iACgAJwAqACcAKQA7ACQA*' # "('*');$
condition: selection
fields:
- CommandLine
- ParentCommandLine
falsepositives:
- Unlikely
level: critical
You can’t perform that action at this time.