Diamond Sleet APT Process Activity Indicators
Detects process creation activity indicators related to Diamond Sleet APT
Sigma rule (View on GitHub)
1title: Diamond Sleet APT Process Activity Indicators
2id: b5495d8d-24ad-4a44-8caf-ceae9a07a5c2
3status: experimental
4description: Detects process creation activity indicators related to Diamond Sleet APT
5references:
6 - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
7author: Nasreddine Bencherchali (Nextron Systems)
8date: 2023/10/24
9tags:
10 - attack.execution
11 - detection.emerging_threats
12logsource:
13 category: process_creation
14 product: windows
15detection:
16 selection:
17 CommandLine|contains: ' uTYNkfKxHiZrx3KJ'
18 condition: selection
19falsepositives:
20 - Unlikely
21level: high
References
Related rules
- Diamond Sleet APT File Creation Indicators
- Diamond Sleet APT Scheduled Task Creation
- Onyx Sleet APT File Creation Indicators
- CVE-2021-1675 Print Spooler Exploitation Filename Pattern
- CVE-2021-26858 Exchange Exploitation