Windows Suspicious UltraVNC Command Line With Auto-Reconnect Flags

title: Windows Suspicious UltraVNC Command Line With Auto-Reconnect Flags
id: 5e488782-f1ed-4e67-8a67-2076a6fcafc6
status: test
description: This rule flags process creation events where the command line contains the UltraVNC auto-reconnect flag, along with a connection string and an ID parameter. Attackers can use these options to automatically re-establish a remote connection after execution, increasing persistence and reducing operator involvement. Detection relies on Windows process creation telemetry and string matches within the full command line.
references:
  - https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine
  - https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution
  - https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ultravnc_susp_execution.yml
author: Bhabesh Raj, Huntrule Team
date: 2022-03-04
modified: 2022-03-09
tags:
  - attack.lateral-movement
  - attack.g0047
  - attack.t1021.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - "-autoreconnect "
      - "-connect "
      - "-id:"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 871b9555-69ca-4993-99d3-35a59f9f3599
    type: derived