DarkGate - Drop DarkGate Loader In C:\Temp Directory

TargetFilename

':\temp\'

'.au3'

'\autoit3.exe'

Image

':\temp\'

'.au3'

'\autoit3.exe'

Detection Query 1

((resourceName = "Windows Security"  AND eventtype = "4688"  ) AND newprocessname = ":\temp"  ) AND processname in (".au3" , "\autoit3.exe")

Detection Query 2

(resourceName = "Sysmon"  AND imagepath = ":\temp"  ) AND image in (".au3" , "\autoit3.exe")

Detection Query 3

((technologygroup = "EDR" AND eventtype = "4688"  ) AND newprocessname = ":\temp"  ) AND processname in (".au3" , "\autoit3.exe")

Detection Query 4

(technologygroup = "EDR"  AND imagepath = ":\temp"  ) AND image in (".au3" , "\autoit3.exe")