EvilNum APT Golden Chickens Deployment Via OCX Files

calendar Jun 20, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats  ·
Share on: linkedin copy

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

Sigma rule (View on GitHub)

 1title: EvilNum APT Golden Chickens Deployment Via OCX Files
 2id: 8acf3cfa-1e8c-4099-83de-a0c4038e18f0
 3status: test
 4description: Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report
 5references:
 6    - https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/
 7    - https://app.any.run/tasks/33d37fdf-158d-4930-aa68-813e1d5eb8ba/
 8author: Florian Roth (Nextron Systems)
 9date: 2020/07/10
10modified: 2023/03/09
11tags:
12    - attack.defense_evasion
13    - attack.t1218.011
14    - detection.emerging_threats
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection:
20        CommandLine|contains|all:
21            - 'regsvr32'
22            - '/s'
23            - '/i'
24            - '\AppData\Roaming\'
25            - '.ocx'
26    condition: selection
27falsepositives:
28    - Unknown
29level: critical

References

Related rules

to-top