Suspicious UltraVNC Execution

calendar Mar 9, 2023 · attack.lateral_movement attack.g0047 attack.t1021.005  ·
Share on: linkedin copy

Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)

Sigma rule (View on GitHub)

 1title: Suspicious UltraVNC Execution
 2id: 871b9555-69ca-4993-99d3-35a59f9f3599
 3status: test
 4description: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
 5references:
 6    - https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf
 7    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine
 8    - https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution
 9    - https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html
10author: Bhabesh Raj
11date: 2022/03/04
12modified: 2022/03/09
13tags:
14    - attack.lateral_movement
15    - attack.g0047
16    - attack.t1021.005
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection:
22        CommandLine|contains|all:
23            - '-autoreconnect '
24            - '-connect '
25            - '-id:'
26    condition: selection
27falsepositives:
28    - Unknown
29level: high

References

Related rules

to-top