Potential Dridex Activity

 1title: Potential Dridex Activity
 2id: e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e
 3status: stable
 4description: Detects potential Dridex acitvity via specific process patterns
 5references:
 6    - https://app.any.run/tasks/993daa5e-112a-4ff6-8b5a-edbcec7c7ba3
 7    - https://redcanary.com/threat-detection-report/threats/dridex/
 8author: Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)
 9date: 2019-01-10
10modified: 2023-02-03
11tags:
12    - attack.defense-evasion
13    - attack.privilege-escalation
14    - attack.t1055
15    - attack.discovery
16    - attack.t1135
17    - attack.t1033
18    - detection.emerging-threats
19logsource:
20    category: process_creation
21    product: windows
22detection:
23    selection_svchost:
24        Image|endswith: '\svchost.exe'
25        CommandLine|contains|all:
26            - 'C:\Users\'
27            - '\Desktop\'
28    filter_svchost:
29        ParentImage|startswith: 'C:\Windows\System32\'
30    selection_regsvr:
31        ParentImage|endswith: '\excel.exe'
32        Image|endswith: '\regsvr32.exe'
33        CommandLine|contains:
34            - ' -s '
35            - '\AppData\Local\Temp\'
36    filter_regsvr:
37        CommandLine|contains: '.dll'
38    selection_anomaly_parent:
39        ParentImage|endswith: '\svchost.exe'
40    selection_anomaly_child_1:
41        Image|endswith: '\whoami.exe'
42        CommandLine|contains: ' /all'
43    selection_anomaly_child_2:
44        Image|endswith:
45            - '\net.exe'
46            - '\net1.exe'
47        CommandLine|contains: ' view'
48    condition: (selection_svchost and not filter_svchost) or (selection_regsvr and not filter_regsvr) or (selection_anomaly_parent and 1 of selection_anomaly_child_*)
49falsepositives:
50    - Unlikely
51level: critical