Turla PNG Dropper Service

calendarApr 14, 2023 · attack.persistence attack.g0010 attack.t1543.003  ·
Share on: linkedincopy

This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

Sigma rule (View on GitHub)

 1title: Turla PNG Dropper Service
 2id: 1228f8e2-7e79-4dea-b0ad-c91f1d5016c1
 3status: test
 4description: This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018
 5references:
 6    - https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/
 7author: Florian Roth (Nextron Systems)
 8date: 2018/11/23
 9modified: 2021/11/30
10tags:
11    - attack.persistence
12    - attack.g0010
13    - attack.t1543.003
14logsource:
15    product: windows
16    service: system
17detection:
18    selection:
19        Provider_Name: 'Service Control Manager'
20        EventID: 7045
21        ServiceName: 'WerFaultSvc'
22    condition: selection
23falsepositives:
24    - Unlikely
25level: critical

Related rules

to-top