Date: 08/21/2024
Severity: High
Summary
Identifies the creation of a file called "dllhost.exe" in the "C:\users\public\Documents" directory, which has been observed in certain variants of the COLDSTEEL RAT.
Indicators of Compromise (IOC) List
TargetFilename | 'C:\users\public\Documents\dllhost.exe' |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | (Resourcename in ("Sysmon") AND eventtype = "11") AND targetfilename = "C:\\users\\public\\Documents\\dllhost.exe" |
Detection Query 2 | (Technologygroup = "EDR" ) AND targetfilename = "C:\\users\\public\\Documents\\dllhost.exe" |
Reference:
Sigma Detection Rule for COLDSTEEL Renamed Command Prompt Executable
NCSC Malware Analysis Report on Cold Steel