Windows process creation: Detect suspicious Turla-related command lines (May 2020)

title: "Windows process creation: Detect suspicious Turla-related command lines (May 2020)"
id: f49e44bd-4f4e-4983-a05b-98debe43c96f
status: test
description: This rule flags specific Windows process creation command lines associated with behavior reported by ESET in May 2020. Attackers may use these crafted commands to establish persistence, execute payload logic, or perform stealthy actions via command-line tooling and encoded or obfuscated strings. Detection relies on Windows process creation telemetry, specifically the command line content of newly spawned processes.
references:
  - https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_comrat_may20.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-05-26
modified: 2025-10-19
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.stealth
  - attack.g0010
  - attack.execution
  - attack.t1059.001
  - attack.t1053.005
  - attack.t1027
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_cli_1:
    CommandLine|contains:
      - tracert -h 10 yahoo.com
      - .WSqmCons))|iex;
      - Fr`omBa`se6`4Str`ing
  selection_cli_2:
    CommandLine|re: net\s+use\s+https://docs.live.net
    CommandLine|contains: "@aol.co.uk"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 9e2e51c5-c699-4794-ba5a-29f5da40ac0c
    type: derived