{"id":"023394c4-29d5-46ab-92b8-6a534c6f447b","title":"Suspicious HWP Sub Processes","description":"Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-10-24","modified":"2021-11-27","tags":["attack.initial-access","attack.t1566.001","attack.execution","attack.t1203","attack.t1059.003","attack.g0032"],"technique_ids":["T1059.003","T1203","T1566.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/","https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1","https://twitter.com/cyberwar_15/status/1187287262054076416","https://blog.alyac.co.kr/1901","https://en.wikipedia.org/wiki/Hangul_(word_processor)"],"source_path":"rules/windows/process_creation/proc_creation_win_hwp_exploits.yml","source_sha256":"8362e5730a725fc743cf15b1dff9042dce435de762b20ad6334c67139eaf1d9e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hwp_exploits.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious HWP Sub Processes\nid: 023394c4-29d5-46ab-92b8-6a534c6f447b\nstatus: test\ndescription: Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation\nreferences:\n    - https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/\n    - https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1\n    - https://twitter.com/cyberwar_15/status/1187287262054076416\n    - https://blog.alyac.co.kr/1901\n    - https://en.wikipedia.org/wiki/Hangul_(word_processor)\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-10-24\nmodified: 2021-11-27\ntags:\n    - attack.initial-access\n    - attack.t1566.001\n    - attack.execution\n    - attack.t1203\n    - attack.t1059.003\n    - attack.g0032\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\Hwp.exe'\n        Image|endswith: '\\gbb.exe'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.003","id":"T1059.003","name":"Windows Command Shell","page":"techniques/enterprise/T1059.003/"},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"},{"key":"enterprise/T1566.001","id":"T1566.001","name":"Spearphishing Attachment","page":"techniques/enterprise/T1566.001/"}],"data_path":"data/detection-rules/023394c4-29d5-46ab-92b8-6a534c6f447b.json","kind":"sigma"}