Potential Ke3chang/TidePool Malware Activity
testhighlog source: windows · process_creationauthor Markus Neis, Swisscomdate 2020-06-18
01
description
What this is, in brief.
Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020
02
tags
attack.defense-impairmentattack.g0004attack.t1685detection.emerging-threats
03
rule source (YAML)
title: Potential Ke3chang/TidePool Malware Activity
id: 7b544661-69fc-419f-9a59-82ccc328f205
status: test
description: Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020
references:
- https://web.archive.org/web/20200618080300/https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf
- https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
author: Markus Neis, Swisscom
date: 2020-06-18
modified: 2023-03-10
tags:
- attack.defense-impairment
- attack.g0004
- attack.t1685
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
# Ke3chang and TidePool both modify the IEHarden registry key, as well as the following list of keys.
# Setting these registry keys is unique to the Ke3chang and TidePool malware families.
# HKCU\Software\Microsoft\Internet Explorer\Main\Check_Associations
# HKCU\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize
# HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IEharden
CommandLine|contains:
- '-Property DWORD -name DisableFirstRunCustomize -value 2 -Force'
- '-Property String -name Check_Associations -value'
- '-Property DWORD -name IEHarden -value 0 -Force'
condition: selection
falsepositives:
- Unknown
level: high
04
detects techniques (1)
ATT&CK techniques this enables or maps to.
05
groups named (1)
Threat groups associated with this.
06
references
External citations — patches, advisories, analysis.