Ursnif Loader

calendar Jan 9, 2023  ·
Share on: linkedin copy

Detects a very specific command the Ursnif loader runs.

Sigma rule (View on GitHub)

 1title: Ursnif Loader
 2id: 4da2fad6-ec4f-4ec6-a7ce-398dc4ff61b5
 3status: Experimental
 4description: Detects a very specific command the Ursnif loader runs.
 5author: svch0st, TheDFIRReport
 6references:
 7  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/time
 8  - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts
 9date: 2023/01/08
10logsource:
11  category: process_creation
12  product: windows
13detection:
14  selection:
15    CommandLine|contains|all:
16      - '/C'
17      - 'pause dll mail'
18    Image|endswith:
19      - 'syswow64\cmd.exe'
20  condition: selection
21fields:
22  - CommandLine
23falsepositives:
24  - Unknown
25level: high

References

  • time

    Reference article for the time command, which displays or sets the system time.


    Read More

  • Unwrapping Ursnifs Gifts

    In late August 2022, we investigated an incident involving Ursnif malware, which resulted in Cobalt Strike being deployed. This was followed by the threat actors moving laterally throughout the env…


    Read More
to-top