HackTool - Jlaive In-Memory Assembly Execution — Sigma Rule

Rule metadata and linked tags

Author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk). Source status: test; severity: medium. Source dates: 2022-05-24 / 2023-02-22.

{
  "product": "windows",
  "category": "process_creation"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: b388a321ed264d48ab276d4a47d02ce49615af70b50b6740a2864ea163fa057c

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: HackTool - Jlaive In-Memory Assembly Execution
id: 0a99eb3e-1617-41bd-b095-13dc767f3def
status: test
description: Detects the use of Jlaive to execute assemblies in a copied PowerShell
references:
    - https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool
    - https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive
author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)
date: 2022-05-24
modified: 2023-02-22
tags:
    - attack.execution
    - attack.t1059.003
logsource:
    product: windows
    category: process_creation
detection:
    parent_selection:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|endswith: '.bat'
    selection1:
        Image|endswith: '\xcopy.exe'
        CommandLine|contains|all:
            - 'powershell.exe'
            - '.bat.exe'
    selection2:
        Image|endswith: '\xcopy.exe'
        CommandLine|contains|all:
            - 'pwsh.exe'
            - '.bat.exe'
    selection3:
        Image|endswith: '\attrib.exe'
        CommandLine|contains|all:
            - '+s'
            - '+h'
            - '.bat.exe'
    condition: parent_selection and (1 of selection*)
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool
• https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive