UNC2452 Process Creation Patterns

    Date: 09/17/2024

    Severity: High

    Summary

    Identifies specific process creation patterns associated with UNC2452, as outlined in Microsoft Defender ATP queries provided by Microsoft.

    Indicators of Compromise (IOC) List

    CommandLine

    '7z.exe a -v500m -mx9 -r0 -p'

    '7z.exe a -mx9 -r0 -p'

     '.zip'

     '.txt'

    '.log'

    'Rundll32.exe'

    'C:\Windows'

    '.dll,Tk_'

     'cmd.exe /C '

    ''

    ParentCommandLine

    'Wscript.exe'

    '.vbs'

    'C:\Windows'

    '.dll'

    ParentImage

    '\rundll32.exe'

    'C:\Windows'

    '.dll'

    Image

    '\dllhost.exe'

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1

    (resourcename = "Windows Security"  AND eventtype = "4688"  ) AND newprocessname In ("7z.exe a -v500m -mx9 -r0 -p","7z.exe a -mx9 -r0 -p",".zip",".txt",".log","rundll32.exe","C:\\Windows",".dll,Tk","\\rundll32.exe",".dll","cmd.exe //C","''" ) AND processname In ("wscript.exe",".vbs","\\dllhost.exe")

    Detection Query 2

    technologygroup = "EDR"  AND newprocessname In ("7z.exe a -v500m -mx9 -r0 -p","7z.exe a -mx9 -r0 -p",".zip",".txt",".log","rundll32.exe","C:\\Windows",".dll,Tk","\\rundll32.exe",".dll","cmd.exe //C","''" ) AND processname In ("wscript.exe",".vbs","\\dllhost.exe")

    Detection Query 3

    resourcename = "Sysmon"  AND eventtype = "1" AND commandline IN ("7z.exe a -v500m -mx9 -r0 -p","7z.exe a -mx9 -r0 -p",".zip",".txt",".log","rundll32.exe","C:\Windows",".dll,Tk_" ,"cmd.exe /C"," " ) AND parentimage = "\rundll32.exe" AND parentcommandline In ("wscript.exe",".vbs","C:\Windows",".dll" ) AND image = "\dllhost.exe"

    Detection Query 4

    technologygroup = "EDR" AND commandline IN ("7z.exe a -v500m -mx9 -r0 -p","7z.exe a -mx9 -r0 -p",".zip",".txt",".log","rundll32.exe","C:\Windows",".dll,Tk_" ,"cmd.exe /C"," ") AND parentimage = "\rundll32.exe" AND parentcommandline In ("wscript.exe",".vbs","C:\Windows",".dll" ) AND image = "\dllhost.exe"

    Reference:

    https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_cmds.yml 


    Tags

    SigmaMalware

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags