Turla Group Lateral Movement
Detects automated lateral movement by Turla group
Sigma rule (View on GitHub)
1title: Turla Group Lateral Movement
2id: c601f20d-570a-4cde-a7d6-e17f99cb8e7f
3status: test
4description: Detects automated lateral movement by Turla group
5references:
6 - https://securelist.com/the-epic-turla-operation/65545/
7author: Markus Neis
8date: 2017-11-07
9modified: 2022-10-09
10tags:
11 - attack.g0010
12 - attack.execution
13 - attack.t1059
14 - attack.lateral-movement
15 - attack.t1021.002
16 - attack.discovery
17 - attack.t1083
18 - attack.t1135
19 - detection.emerging-threats
20logsource:
21 category: process_creation
22 product: windows
23detection:
24 selection:
25 CommandLine:
26 - 'net use \\\\%DomainController%\C$ "P@ssw0rd" *'
27 - 'dir c:\\*.doc* /s'
28 - 'dir %TEMP%\\*.exe'
29 condition: selection
30falsepositives:
31 - Unknown
32level: critical
References
Related rules
- WannaCry Ransomware Activity
- CobaltStrike Service Installations - Security
- CobaltStrike Service Installations - System
- Hacktool Ruler
- Hermetic Wiper TG Process Patterns