Windows Process Creation: UC Berkeley/BOINC-Related Software Execution String Match

Alerts on Windows process creation events whose Description contains "University of California, Berkeley."

FreeUnreviewedSigmainformationalv1

windows-process-creation-uc-berkeley-boinc-related-software-execution-string-mat-0090b851

title: "Windows Process Creation: UC Berkeley/BOINC-Related Software Execution String Match"
id: 6e2158c8-178a-40bd-8cf6-061e4636833c
status: test
description: This rule flags Windows process creation events where the process metadata description contains the text "University of California, Berkeley." The behavior may indicate execution of UC Berkeley/BOINC-associated software, which could be leveraged for unauthorized activity depending on context and authorization. It relies on process creation telemetry with a populated Description field that includes that specific string.
references:
  - https://boinc.berkeley.edu/
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_boinc_execution.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2024-07-23
tags:
  - attack.execution
  - attack.defense-impairment
  - attack.t1553
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Description: University of California, Berkeley
  condition: selection
falsepositives:
  - This software can be used for legitimate purposes when installed intentionally.
level: informational
license: DRL-1.1
related:
  - id: 0090b851-3543-42db-828c-02fee986ff0b
    type: derived

What it detects

This rule flags Windows process creation events where the process metadata description contains the text "University of California, Berkeley." The behavior may indicate execution of UC Berkeley/BOINC-associated software, which could be leveraged for unauthorized activity depending on context and authorization. It relies on process creation telemetry with a populated Description field that includes that specific string.

Known false positives

This software can be used for legitimate purposes when installed intentionally.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.