{"id":"0bcfabcb-7929-47f4-93d6-b33fb67d34d1","title":"Adwind RAT / JRAT File Artifact","description":"Detects javaw.exe in AppData folder as used by Adwind / JRAT","author":"Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2017-11-10","modified":"2022-12-02","tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"technique_ids":["T1059.005","T1059.007"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":[],"references":["https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100","https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf"],"source_path":"rules/windows/file/file_event/file_event_win_mal_adwind.yml","source_sha256":"7f667d4d911f22444bd73012eaae058164b125b7e99e9ad136badbc271fac24e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_mal_adwind.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Adwind RAT / JRAT File Artifact\nid: 0bcfabcb-7929-47f4-93d6-b33fb67d34d1\nrelated:\n    - id: 1fac1481-2dbc-48b2-9096-753c49b4ec71\n      type: derived\nstatus: test\ndescription: Detects javaw.exe in AppData folder as used by Adwind / JRAT\nreferences:\n    - https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100\n    - https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf\nauthor: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community\ndate: 2017-11-10\nmodified: 2022-12-02\ntags:\n    - attack.execution\n    - attack.t1059.005\n    - attack.t1059.007\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        - TargetFilename|contains|all:\n              - '\\AppData\\Roaming\\Oracle\\bin\\java'\n              - '.exe'\n        - TargetFilename|contains|all:\n              - '\\Retrive'\n              - '.vbs'\n    condition: selection\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"}],"data_path":"data/detection-rules/0bcfabcb-7929-47f4-93d6-b33fb67d34d1.json","kind":"sigma"}