huntrule

Windows Process Creation—Command-Line Patterns Used in Lazarus Activity Tests

Alerts on Windows process executions with command-line substrings consistent with behaviors described in Lazarus activity reports.

FreeUnreviewedSigmacriticalv1
title: Windows Process Creation—Command-Line Patterns Used in Lazarus Activity Tests
id: bd430b38-0e10-431f-810d-9765e5c0e01a
related:
  - id: 7b49c990-4a9a-4e65-ba95-47c9cc448f6e
    type: obsolete
  - id: 24c4d154-05a4-4b99-b57d-9b977472443a
    type: derived
status: test
description: This rule flags Windows process creation events whose command lines match one of several hardcoded execution patterns tied to described Lazarus activity reporting. The behaviors focus on command-line activity consistent with credential-dumping style registry save usage, system/network enumeration, and execution from temporary or recycled locations. It relies on process creation telemetry that includes command-line arguments so the matched substrings can be identified reliably.
references:
  - https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/
  - https://www.hvs-consulting.de/lazarus-report/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/Lazarus/proc_creation_win_apt_lazarus_group_activity.yml
author: Florian Roth (Nextron Systems), wagga, Huntrule Team
date: 2020-12-23
modified: 2023-03-10
tags:
  - attack.g0032
  - attack.execution
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_generic:
    CommandLine|contains:
      - reg.exe save hklm\sam %temp%\~reg_sam.save
      - 1q2w3e4r@#$@#$@#$
      - " -hp1q2w3e4 "
      - ".dat data03 10000 -p "
  selection_netstat:
    CommandLine|contains|all:
      - "netstat -aon | find "
      - ESTA
      - " > %temp%\\~"
  selection_network_discovery:
    CommandLine|contains|all:
      - .255 10 C:\ProgramData\IBM\
      - .DAT
  selection_persistence:
    CommandLine|contains|all:
      - " /c "
      - " -p 0x"
    CommandLine|contains:
      - C:\ProgramData\
      - C:\RECYCLER\
  selection_rundll32:
    CommandLine|contains|all:
      - "rundll32 "
      - C:\ProgramData\
    CommandLine|contains:
      - .bin,
      - .tmp,
      - .dat,
      - .io,
      - .ini,
      - .db,
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1

What it detects

This rule flags Windows process creation events whose command lines match one of several hardcoded execution patterns tied to described Lazarus activity reporting. The behaviors focus on command-line activity consistent with credential-dumping style registry save usage, system/network enumeration, and execution from temporary or recycled locations. It relies on process creation telemetry that includes command-line arguments so the matched substrings can be identified reliably.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.