Pandemic Registry Key

calendar Aug 12, 2024 · attack.command-and-control attack.t1105  ·
Share on: linkedin copy

Detects Pandemic Windows Implant

Sigma rule (View on GitHub)

 1title: Pandemic Registry Key
 2id: 47e0852a-cf81-4494-a8e6-31864f8c86ed
 3status: test
 4description: Detects Pandemic Windows Implant
 5references:
 6    - https://wikileaks.org/vault7/#Pandemic
 7    - https://twitter.com/MalwareJake/status/870349480356454401
 8author: Florian Roth (Nextron Systems)
 9date: 2017-06-01
10modified: 2022-10-09
11tags:
12    - attack.command-and-control
13    - attack.t1105
14logsource:
15    category: registry_event
16    product: windows
17detection:
18    selection:
19        TargetObject|contains: '\SYSTEM\CurrentControlSet\services\null\Instance'
20    condition: selection
21falsepositives:
22    - Unknown
23level: critical

References

Related rules

to-top