Windows process executions associated with Greenbug-style PowerShell and reverse shell tooling

title: Windows process executions associated with Greenbug-style PowerShell and reverse shell tooling
id: c9f339ee-c4b0-4191-a9a6-42d8e46ee07d
status: test
description: This rule flags specific Windows process creation events where executable paths and command-line patterns match tooling described in a campaign report, including PowerShell usage consistent with execution policy bypass and hidden/in-memory behavior. It also looks for command-line characteristics tied to reverse shell and file/command execution patterns. The detection relies on Windows process creation telemetry, including the Image path and full CommandLine content.
references:
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/Greenbug/proc_creation_win_apt_greenbug_may20.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-05-20
modified: 2023-03-09
tags:
  - attack.stealth
  - attack.g0049
  - attack.execution
  - attack.t1059.001
  - attack.command-and-control
  - attack.t1105
  - attack.t1036.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - :\ProgramData\adobe\Adobe.exe
      - :\ProgramData\oracle\local.exe
      - \revshell.exe
      - \infopagesbackup\ncat.exe
      - :\ProgramData\comms\comms.exe
  selection_msf:
    CommandLine|contains|all:
      - -ExecutionPolicy Bypass -File
      - \msf.ps1
  selection_ncat:
    CommandLine|contains|all:
      - infopagesbackup
      - \ncat
      - -e cmd.exe
  selection_powershell:
    CommandLine|contains:
      - system.Data.SqlClient.SqlDataAdapter($cmd); [void]$da.fill
      - -nop -w hidden -c $k=new-object
      - "[Net.CredentialCache]::DefaultCredentials;IEX "
      - " -nop -w hidden -c $m=new-object net.webclient;$m"
      - -noninteractive -executionpolicy bypass whoami
      - -noninteractive -executionpolicy bypass netstat -a
  selection_other:
    CommandLine|contains: L3NlcnZlcj1
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 3711eee4-a808-4849-8a14-faf733da3612
    type: derived