HackTool - Jlaive In-Memory Assembly Execution

testmedium
Log-Quelle: windows · process_creationAutor Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)Datum 2022-05-24
01

Beschreibung

Was dies ist, in Kürze.

Detects the use of Jlaive to execute assemblies in a copied PowerShell

02

Tags

attack.executionattack.t1059.003
03

Regelquelle (YAML)

title: HackTool - Jlaive In-Memory Assembly Execution
id: 0a99eb3e-1617-41bd-b095-13dc767f3def
status: test
description: Detects the use of Jlaive to execute assemblies in a copied PowerShell
references:
    - https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool
    - https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive
author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)
date: 2022-05-24
modified: 2023-02-22
tags:
    - attack.execution
    - attack.t1059.003
logsource:
    product: windows
    category: process_creation
detection:
    parent_selection:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|endswith: '.bat'
    selection1:
        Image|endswith: '\xcopy.exe'
        CommandLine|contains|all:
            - 'powershell.exe'
            - '.bat.exe'
    selection2:
        Image|endswith: '\xcopy.exe'
        CommandLine|contains|all:
            - 'pwsh.exe'
            - '.bat.exe'
    selection3:
        Image|endswith: '\attrib.exe'
        CommandLine|contains|all:
            - '+s'
            - '+h'
            - '.bat.exe'
    condition: parent_selection and (1 of selection*)
falsepositives:
    - Unknown
level: medium
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.