SOURGUM Actor Behaviours

calendar Aug 12, 2024 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege-escalation detection.emerging-threats  ·
Share on: linkedin copy

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Sigma rule (View on GitHub)

 1title: SOURGUM Actor Behaviours
 2id: 7ba08e95-1e0b-40cd-9db5-b980555e42fd
 3status: test
 4description: Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
 5references:
 6    - https://www.virustotal.com/gui/file/c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d/detection
 7    - https://github.com/Azure/Azure-Sentinel/blob/43e9be273dca321295190bfc4902858e009d4a35/Detections/MultipleDataSources/SOURGUM_IOC.yaml
 8    - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
 9author: MSTIC, FPT.EagleEye
10date: 2021-06-15
11modified: 2022-10-09
12tags:
13    - attack.t1546
14    - attack.t1546.015
15    - attack.persistence
16    - attack.privilege-escalation
17    - detection.emerging-threats
18logsource:
19    product: windows
20    category: process_creation
21detection:
22    selection:
23        Image|contains:
24            - 'windows\system32\Physmem.sys'
25            - 'Windows\system32\ime\SHARED\WimBootConfigurations.ini'
26            - 'Windows\system32\ime\IMEJP\WimBootConfigurations.ini'
27            - 'Windows\system32\ime\IMETC\WimBootConfigurations.ini'
28    registry_image:
29        Image|contains:
30            - 'windows\system32\filepath2'
31            - 'windows\system32\ime'
32        CommandLine|contains: 'reg add'
33    registry_key:
34        CommandLine|contains:
35            - 'HKEY_LOCAL_MACHINE\software\classes\clsid\{7c857801-7381-11cf-884d-00aa004b2e24}\inprocserver32'
36            - 'HKEY_LOCAL_MACHINE\software\classes\clsid\{cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}\inprocserver32'
37    condition: selection or all of registry_*
38falsepositives:
39    - Unknown
40level: high

References

Related rules

to-top