Potential GobRAT File Discovery Via Grep

 1title: Potential GobRAT File Discovery Via Grep
 2id: e34cfa0c-0a50-4210-9cb3-5632d08eb041
 3status: test
 4description: Detects the use of grep to discover specific files created by the GobRAT malware
 5references:
 6    - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
 7    - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
 8    - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
 9author: Joseliyo Sanchez, @Joseliyo_Jstnk
10date: 2023-06-02
11tags:
12    - attack.discovery
13    - attack.t1082
14logsource:
15    category: process_creation
16    product: linux
17detection:
18    selection:
19        Image|endswith: '/grep'
20        CommandLine|contains:
21            - 'apached'
22            - 'frpc'
23            - 'sshd.sh'
24            - 'zone.arm'
25    condition: selection
26falsepositives:
27    - Unknown
28level: high

References

• GobRAT malware written in Go language targeting Linux routers - JPCERT/CC Eyes

  

  JPCERT/CC has confirmed attacks that infected routers in Japan with malware around February 2023. This blog article explains the details of the attack confirmed by JPCERT/CC and GobRAT malware, which was used in the attack. ### Attack flow up to...

  
  Read More

• VirusTotal

  VirusTotal

  
  Read More

• VirusTotal

  VirusTotal

  
  Read More

Related rules

• Bitbucket User Details Export Attempt Detected
• Cisco Discovery
• Container Residence Discovery Via Proc Virtual FS
• Docker Container Discovery Via Dockerenv Listing
• HackTool - PCHunter Execution