DarkGate - Drop DarkGate Loader In C:\Temp Directory
Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
Sigma rule (View on GitHub)
1title: DarkGate - Drop DarkGate Loader In C:\Temp Directory
2id: df49c691-8026-48dd-94d3-4ba6a79102a8
3status: experimental
4description: Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
5references:
6 - https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
7 - https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
8author: Tomasz Dyduch, Josh Nickels
9date: 2024-05-31
10tags:
11 - attack.execution
12 - attack.t1059
13logsource:
14 category: file_event
15 product: windows
16detection:
17 selection_filename_suffix:
18 TargetFilename|contains: ':\temp\'
19 TargetFilename|endswith:
20 - '.au3'
21 - '\autoit3.exe'
22 selection_image_suffix:
23 Image|contains: ':\temp\'
24 Image|endswith:
25 - '.au3'
26 - '\autoit3.exe'
27 condition: 1 of selection_*
28falsepositives:
29 - Unlikely legitimate usage of AutoIT in temp folders.
30level: medium
References
Related rules
- Abusable DLL Potential Sideloading From Suspicious Location
- Add Insecure Download Source To Winget
- Add New Download Source To Winget
- Add Potential Suspicious New Download Source To Winget
- Atlassian Confluence CVE-2022-26134