Windows process creation matching Htran/NATBypass executable names and CLI flags

title: Windows process creation matching Htran/NATBypass executable names and CLI flags
id: 2b18342b-adaa-4483-bee8-11516683d822
status: test
description: This rule flags Windows process creation events where the executed image name ends with htran.exe or lcx.exe, or where the command line contains Htran-style execution flags such as '.exe -tran ' or '.exe -slave '. Such tooling is commonly used to establish or relay connectivity, so matching these indicators helps identify suspicious command-and-control related activity. The detection relies on process creation telemetry, specifically the image path and command line contents.
references:
  - https://github.com/HiwinCN/HTran
  - https://github.com/cw1997/NATBypass
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_htran_or_natbypass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-12-27
modified: 2023-02-04
tags:
  - attack.command-and-control
  - attack.t1090
  - attack.s0040
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \htran.exe
      - \lcx.exe
  selection_cli:
    CommandLine|contains:
      - ".exe -tran "
      - ".exe -slave "
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f5e3b62f-e577-4e59-931e-0a15b2b94e1e
    type: derived