Turla Group Lateral Movement

testcritical

log source: windows · process_creationauthor Markus Neisdate 2017-11-07

description

What this is, in brief.

Detects automated lateral movement by Turla group

rule source (YAML)

title: Turla Group Lateral Movement
id: c601f20d-570a-4cde-a7d6-e17f99cb8e7f
status: test
description: Detects automated lateral movement by Turla group
references:
    - https://securelist.com/the-epic-turla-operation/65545/
author: Markus Neis
date: 2017-11-07
modified: 2022-10-09
tags:
    - attack.g0010
    - attack.execution
    - attack.t1059
    - attack.lateral-movement
    - attack.t1021.002
    - attack.discovery
    - attack.t1083
    - attack.t1135
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine:
            - 'net use \\\\%DomainController%\C$ "P@ssw0rd" *'
            - 'dir c:\\*.doc* /s'
            - 'dir %TEMP%\\*.exe'
    condition: selection
falsepositives:
    - Unknown
level: critical

detects techniques (4)

ATT&CK techniques this enables or maps to.

groups named (1)

Threat groups associated with this.

G0010Turla

references

External citations — patches, advisories, analysis.

https://securelist.com/the-epic-turla-operation/65545/