Potential Russian APT Credential Theft Activity

 1title: Potential Russian APT Credential Theft Activity
 2id: b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee
 3status: stable
 4description: Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike
 5references:
 6    - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
 7author: Florian Roth (Nextron Systems)
 8date: 2019/02/21
 9modified: 2023/03/08
10tags:
11    - attack.credential_access
12    - attack.t1552.001
13    - attack.t1003.003
14    - detection.emerging_threats
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection_xcopy:
20        CommandLine|contains|all:
21            - 'xcopy /S /E /C /Q /H \\\\'
22            - '\sysvol\'
23    selection_adexplorer:
24        CommandLine|contains|all:
25            - 'adexplorer -snapshot "" c:\users\'
26            - '\downloads\'
27            - '.snp'
28    condition: 1 of selection_*
29falsepositives:
30    - Unlikely
31level: critical