Kavremover Dropped Binary LOLBIN Usage
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
Sigma rule (View on GitHub)
1title: Kavremover Dropped Binary LOLBIN Usage
2id: d047726b-c71c-4048-a99b-2e2f50dc107d
3status: test
4description: Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
5references:
6 - https://nasbench.medium.com/lolbined-using-kaspersky-endpoint-security-kes-installer-to-execute-arbitrary-commands-1c999f1b7fea
7author: Nasreddine Bencherchali (Nextron Systems)
8date: 2022/11/01
9tags:
10 - attack.defense_evasion
11 - attack.t1127
12logsource:
13 product: windows
14 category: process_creation
15detection:
16 selection:
17 CommandLine|contains: ' run run-cmd '
18 filter:
19 ParentImage|endswith:
20 - '\kavremover.exe' # When launched from kavremover.exe
21 - '\cleanapi.exe' # When launched from KES installer
22 condition: selection and not filter
23falsepositives:
24 - Unknown
25level: high
References
Related rules
- Ilasm Lolbin Use Compile C-Sharp
- JSC Convert Javascript To Executable
- Node Process Executions
- Remote Thread Creation Ttdinject.exe Proxy
- Use of Remote.exe