{"id":"12fbff88-16b5-4b42-9754-cd001a789fb3","title":"CodePage Modification Via MODE.COM To Russian Language","description":"Detects a CodePage modification using the \"mode.com\" utility to Russian language.\nThis behavior has been used by threat actors behind Dharma ransomware.\n","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2024-01-17","modified":"","tags":["attack.stealth","attack.t1036"],"technique_ids":["T1036"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Russian speaking people changing the CodePage"],"references":["https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode","https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html","https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior"],"source_path":"rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml","source_sha256":"03d806edadc9a4138450f077dce782acb1e0714836c7b7cf5464f17f6f31ab3b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: CodePage Modification Via MODE.COM To Russian Language\nid: 12fbff88-16b5-4b42-9754-cd001a789fb3\nrelated:\n    - id: d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e\n      type: derived\nstatus: test\ndescription: |\n    Detects a CodePage modification using the \"mode.com\" utility to Russian language.\n    This behavior has been used by threat actors behind Dharma ransomware.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode\n    - https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html\n    - https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2024-01-17\ntags:\n    - attack.stealth\n    - attack.t1036\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # VT Query: behavior:\"mode con cp select=1251\"\n    # VT Query: behavior:\"mode con cp select=866\"\n    selection_img:\n        - Image|endswith: '\\mode.com'\n        - OriginalFileName: 'MODE.COM'\n    selection_cli:\n        CommandLine|contains|all:\n            - ' con '\n            - ' cp '\n            - ' select='\n        CommandLine|endswith:\n            - '=1251' # ANSI Cyrillic; Cyrillic (Windows) - Observed ITW by Dharma ransomware\n            - '=866' # OEM Russian; Cyrillic (DOS) - Observed ITW by other malware\n    condition: all of selection_*\nfalsepositives:\n    - Russian speaking people changing the CodePage\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/12fbff88-16b5-4b42-9754-cd001a789fb3.json","kind":"sigma"}