{"id":"3ceb2083-a27f-449a-be33-14ec1b7cc973","title":"Silence.EDA Detection","description":"Detects Silence EmpireDNSAgent as described in the Group-IP report","author":"Alina Stepchenkova, Group-IB, oscd.community","status":"test","level":"critical","date":"2019-11-01","modified":"2023-04-03","tags":["attack.execution","attack.t1059.001","attack.command-and-control","attack.t1071.004","attack.t1572","attack.impact","attack.t1529","attack.g0091","attack.s0363"],"technique_ids":["T1059.001","T1071.004","T1529","T1572"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Unknown"],"references":["https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml","source_sha256":"73a67d10262bc8d19ddf40fcd858981b27ce262f97ef29db88d4eb5628327f58","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Silence.EDA Detection\nid: 3ceb2083-a27f-449a-be33-14ec1b7cc973\nstatus: test\ndescription: Detects Silence EmpireDNSAgent as described in the Group-IP report\nreferences:\n    - https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf\nauthor: Alina Stepchenkova, Group-IB, oscd.community\ndate: 2019-11-01\nmodified: 2023-04-03\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command-and-control\n    - attack.t1071.004\n    - attack.t1572\n    - attack.impact\n    - attack.t1529\n    - attack.g0091\n    - attack.s0363\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    empire:\n        # better to randomise the order\n        ScriptBlockText|contains|all:\n            - 'System.Diagnostics.Process'\n            - 'Stop-Computer'\n            - 'Restart-Computer'\n            - 'Exception in execution'\n            - '$cmdargs'\n            - 'Close-Dnscat2Tunnel'\n    dnscat:\n        # better to randomise the order\n        ScriptBlockText|contains|all:\n            - 'set type=$LookupType`nserver'\n            - '$Command | nslookup 2>&1 | Out-String'\n            - 'New-RandomDNSField'\n            - '[Convert]::ToString($SYNOptions, 16)'\n            - '$Session.Dead = $True'\n            - '$Session[\"Driver\"] -eq'\n    condition: empire and dnscat\nfalsepositives:\n    - Unknown\nlevel: critical\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1071.004","id":"T1071.004","name":"DNS","page":"techniques/enterprise/T1071.004/"},{"key":"enterprise/T1529","id":"T1529","name":"System Shutdown/Reboot","page":"techniques/enterprise/T1529/"},{"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","page":"techniques/enterprise/T1572/"}],"data_path":"data/detection-rules/3ceb2083-a27f-449a-be33-14ec1b7cc973.json","kind":"sigma"}