Turla Group Lateral Movement

calendar Aug 12, 2024 · attack.g0010 attack.execution attack.t1059 attack.lateral-movement attack.t1021.002 attack.discovery attack.t1083 attack.t1135 detection.emerging-threats  ·
Share on: linkedin copy

Detects automated lateral movement by Turla group

Sigma rule (View on GitHub)

 1title: Turla Group Lateral Movement
 2id: c601f20d-570a-4cde-a7d6-e17f99cb8e7f
 3status: test
 4description: Detects automated lateral movement by Turla group
 5references:
 6    - https://securelist.com/the-epic-turla-operation/65545/
 7author: Markus Neis
 8date: 2017-11-07
 9modified: 2022-10-09
10tags:
11    - attack.g0010
12    - attack.execution
13    - attack.t1059
14    - attack.lateral-movement
15    - attack.t1021.002
16    - attack.discovery
17    - attack.t1083
18    - attack.t1135
19    - detection.emerging-threats
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection:
25        CommandLine:
26            - 'net use \\\\%DomainController%\C$ "P@ssw0rd" *'
27            - 'dir c:\\*.doc* /s'
28            - 'dir %TEMP%\\*.exe'
29    condition: selection
30falsepositives:
31    - Unknown
32level: critical

References

  • The Epic Turla Operation

    Over the last 10 months, we have analyzed a massive cyber-espionage operation which we call “Epic Turla”. The attackers have infected several hundred computers in more than 45 countries, including government institutions, embassies, military, education, research and pharmaceutical companies. We observed exploits against older (patched) vulnerabilities, social engineering techniques and watering hole strategies.


    Read More

Related rules

to-top