Windows process command line matches Griffon malware execution pattern

Alerts on Windows process command lines containing a temp staging path plus jscript execution indicators and a .txt target.

FreeUnreviewedSigmacriticalv1

windows-process-command-line-matches-griffon-malware-execution-pattern-bcc6f179

title: Windows process command line matches Griffon malware execution pattern
id: 4e730ae8-a5c5-491e-86d0-a8e6b65af924
status: test
description: This rule flags Windows process executions whose command line contains a specific local temp path plus the jscript compilation/execution switch and a .txt file extension. Such a pattern is relevant because attackers commonly stage and run scripts from temporary directories and invoke script execution via command-line arguments. The detection relies on process creation telemetry with a readable command line to match those substrings together.
references:
  - https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Griffon/proc_creation_win_malware_griffon_patterns.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-09
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - \local\temp\
      - //b /e:jscript
      - .txt
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: bcc6f179-11cd-4111-a9a6-0fab68515cf7
    type: derived

What it detects

This rule flags Windows process executions whose command line contains a specific local temp path plus the jscript compilation/execution switch and a .txt file extension. Such a pattern is relevant because attackers commonly stage and run scripts from temporary directories and invoke script execution via command-line arguments. The detection relies on process creation telemetry with a readable command line to match those substrings together.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.