Windows process command lines matching May 2020 Turla ComRAT command patterns
Triggers on Windows command lines matching a set of Turla-related indicators documented by ESET (May 2020).
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-05-26
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creations where the command line matches specific Turla group ComRAT-related command patterns described in the referenced ESET report. Attackers may use these command invocations to execute follow-on actions, including execution and persistence techniques. It relies on process creation telemetry with command-line data and matches either exact substrings or a defined regular expression pattern in the CommandLine field.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows process command lines matching May 2020 Turla ComRAT command patterns
id: f49e44bd-4f4e-4983-a05b-98debe43c96f
status: test
description: This rule identifies Windows process creations where the command line matches specific Turla group ComRAT-related command patterns described in the referenced ESET report. Attackers may use these command invocations to execute follow-on actions, including execution and persistence techniques. It relies on process creation telemetry with command-line data and matches either exact substrings or a defined regular expression pattern in the CommandLine field.
references:
- https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_comrat_may20.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-05-26
modified: 2025-10-19
tags:
- attack.privilege-escalation
- attack.persistence
- attack.stealth
- attack.g0010
- attack.execution
- attack.t1059.001
- attack.t1053.005
- attack.t1027
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_cli_1:
CommandLine|contains:
- tracert -h 10 yahoo.com
- .WSqmCons))|iex;
- Fr`omBa`se6`4Str`ing
selection_cli_2:
CommandLine|re: net\s+use\s+https://docs.live.net
CommandLine|contains: "@aol.co.uk"
condition: 1 of selection_*
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 9e2e51c5-c699-4794-ba5a-29f5da40ac0c
type: derived