Create image_load_susp_dotnet_csharp_streamer_rat.yml

LucaInfoSec commented 6 days ago

Summary of the Pull Request

Sigma rule for the CSharp Streamer RAT.

Detection is based on the default file name and path used by the CSharp Streamer RAT to write and load .NET executables.

References here:

Changelog

new: Potential CSharp Streamer RAT Loading .NET Executable Image

Example Log Event

Image loaded:
RuleName: technique_id=T1574.002,technique_name=DLL Side-Loading
UtcTime: -
ProcessGuid: {87714b33-0f0c-6528-0674-020000000400}
ProcessId: 11528
Image: C:\test\cslite.exe
ImageLoaded: C:\Users\test\AppData\Local\Temp\dat8E8A.tmp
FileVersion: -
Description: -
Product: -
Company: -
OriginalFileName: -
Hashes: SHA1=9918492B6A1BD5ED40109B53C3ACDDD8C5F370F5,MD5=CF3C9C1E8D8B525425B5BD1DF90B7928, SHA256=C6012796E6FCCFF612B9AE0A981A56878847DCE5A9C3BB324E653A07526BE096,IMPHASH=00000000000000000000000000000000
Signed: false
Signature: -
SignatureStatus: Unavailable
User: test

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

If your PR adds new rules, please consider following and applying these conventions

nasbench commented 4 days ago

Thanks for the contribution @LucaInfoSec. Just a quick question did you check the code to verify the length and the allowed characters for the filename? If so, can you please share an SS or a link?

From the DFIR report link and the cyber.wtf there isn't a direct evidence.

Thanks

LucaInfoSec commented 4 days ago

Hi @nasbench, Unfortunately no, I could not get my hands on a sample of the malware so the two examples of this \dat[0-9A-Z]{4}.tmp format is the two examples provided in the report:

dat8E8A.tmp
dat956D.tmp I believe the format is just any four numbers or letters (the letters and numbers most likely being hexadecimal format but in the rule I include [A-Z] instead of [A-F] just incase this assumption is incorrect). It is a rare format so it should be unlikely that it will result in false positives.

If this is not enough we can close the PR until I have more concrete evidence of this.

nasbench commented 4 days ago

I approved from a logic perspective. But i'll need to double check that this is an expected behavior. As the cyber.wtf didn't mention it. And looking at the 2 samples linked in that blog sample1 and sample2. VT behavior tab doesn't show that file being dropped.

I'll keep this open for a bit more.

SigmaHQ / sigma