Windows Process Creation: Detects Command-Line String uTYNkfKxHiZrx3KJ

title: "Windows Process Creation: Detects Command-Line String uTYNkfKxHiZrx3KJ"
id: 130e1dd6-5c46-4014-8702-7ac8cd2c66a4
status: test
description: This rule flags Windows process creation events where the command line contains the string ' uTYNkfKxHiZrx3KJ'. Attackers may use distinctive command-line arguments to run tooling, payloads, or staged commands, making these rare indicators valuable for high-confidence triage. It relies on telemetry from process creation logs that include the full command line for the spawned process.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/proc_creation_win_apt_diamond_sleet_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: " uTYNkfKxHiZrx3KJ"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: b5495d8d-24ad-4a44-8caf-ceae9a07a5c2
    type: derived