huntrule

Windows Process Execution with 'University of California, Berkeley' Description

Alerts on Windows process creation events whose Description contains "University of California, Berkeley."

FreeReviewedSigma · Informational · v5
Product
windows
Category
process_creation
Author
Matt Anderson (Huntress) (SigmaHQ), DRL 1.1
Published
2024-07-23
Updated
2026-07-31
AnalysisDetection
title: Windows Process Execution with 'University of California, Berkeley' Description
id: 6e2158c8-178a-40bd-8cf6-061e4636833c
status: test
description: This rule flags newly created Windows processes whose recorded Description contains the text "University of California, Berkeley." Adversaries may reuse legitimate software branding or bundled components to blend in with expected scientific or computing tools. The detection relies on process creation telemetry and the Description field in the event to identify the specific metadata string.
references:
  - https://boinc.berkeley.edu/
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_boinc_execution.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2024-07-23
tags:
  - attack.execution
  - attack.defense-impairment
  - attack.t1553
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Description: University of California, Berkeley
  condition: selection
falsepositives:
  - This software can be used for legitimate purposes when installed intentionally.
level: informational
license: DRL-1.1
related:
  - id: 0090b851-3543-42db-828c-02fee986ff0b
    type: derived