{"id":"0a99eb3e-1617-41bd-b095-13dc767f3def","title":"HackTool - Jlaive In-Memory Assembly Execution","description":"Detects the use of Jlaive to execute assemblies in a copied PowerShell","author":"Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)","status":"test","level":"medium","date":"2022-05-24","modified":"2023-02-22","tags":["attack.execution","attack.t1059.003"],"technique_ids":["T1059.003"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool","https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml","source_sha256":"b388a321ed264d48ab276d4a47d02ce49615af70b50b6740a2864ea163fa057c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Jlaive In-Memory Assembly Execution\nid: 0a99eb3e-1617-41bd-b095-13dc767f3def\nstatus: test\ndescription: Detects the use of Jlaive to execute assemblies in a copied PowerShell\nreferences:\n    - https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool\n    - https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive\nauthor: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)\ndate: 2022-05-24\nmodified: 2023-02-22\ntags:\n    - attack.execution\n    - attack.t1059.003\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    parent_selection:\n        ParentImage|endswith: '\\cmd.exe'\n        ParentCommandLine|endswith: '.bat'\n    selection1:\n        Image|endswith: '\\xcopy.exe'\n        CommandLine|contains|all:\n            - 'powershell.exe'\n            - '.bat.exe'\n    selection2:\n        Image|endswith: '\\xcopy.exe'\n        CommandLine|contains|all:\n            - 'pwsh.exe'\n            - '.bat.exe'\n    selection3:\n        Image|endswith: '\\attrib.exe'\n        CommandLine|contains|all:\n            - '+s'\n            - '+h'\n            - '.bat.exe'\n    condition: parent_selection and (1 of selection*)\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.003","id":"T1059.003","name":"Windows Command Shell","page":"techniques/enterprise/T1059.003/"}],"data_path":"data/detection-rules/0a99eb3e-1617-41bd-b095-13dc767f3def.json","kind":"sigma"}