Adwind RAT / JRAT

calendar Oct 18, 2023 · attack.execution attack.t1059.005 attack.t1059.007 detection.emerging_threats  ·
Share on: linkedin copy

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Sigma rule (View on GitHub)

 1title: Adwind RAT / JRAT
 2id: 1fac1481-2dbc-48b2-9096-753c49b4ec71
 3status: test
 4description: Detects javaw.exe in AppData folder as used by Adwind / JRAT
 5references:
 6    - https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
 7    - https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
 8author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
 9date: 2017/11/10
10modified: 2022/10/09
11tags:
12    - attack.execution
13    - attack.t1059.005
14    - attack.t1059.007
15    - detection.emerging_threats
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection:
21        - CommandLine|contains|all:
22              - '\AppData\Roaming\Oracle'
23              - '\java'
24              - '.exe '
25        - CommandLine|contains|all:
26              - 'cscript.exe'
27              - 'Retrive'
28              - '.vbs '
29    condition: selection
30level: high

References

Related rules

to-top