Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32

testmedium
Log-Quelle: windows · process_creationAutor Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)Datum 2019-10-02
01

Beschreibung

Was dies ist, in Kürze.

Detects potential BlueMushroom DLL loading activity via regsvr32 from AppData Local

02

Tags

attack.stealthattack.t1218.010detection.emerging-threats
03

Regelquelle (YAML)

title: Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32
id: bd70d3f8-e60e-4d25-89f0-0b5a9cff20e0
status: test
description: Detects potential BlueMushroom DLL loading activity via regsvr32 from AppData Local
references:
    - https://pbs.twimg.com/media/EF3yLGoWkAEGeLa?format=jpg
author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
date: 2019-10-02
modified: 2023-03-29
tags:
    - attack.stealth
    - attack.t1218.010
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'regsvr32'
            - '\AppData\Local\'
            - '.dll'
            - ',DllEntry'
    condition: selection
falsepositives:
    - Unknown
level: medium
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.