Suspicious Unsigned Thor Scanner Execution — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems). Source status: stable; severity: high. Source dates: 2023-10-29 / not supplied.

{
  "category": "image_load",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 494c5163300d274fe8c653b7fa39fe1b1e3e25a3d7159dea40a542de53defb35

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious Unsigned Thor Scanner Execution
id: ea5c131b-380d-49f9-aeb3-920694da4d4b
status: stable
description: Detects loading and execution of an unsigned thor scanner binary.
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-10-29
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith:
            - '\thor.exe'
            - '\thor64.exe'
        ImageLoaded|endswith:
            - '\thor.exe'
            - '\thor64.exe'
    filter_main:
        Signed: 'true'
        SignatureStatus: 'valid'
        Signature: 'Nextron Systems GmbH'
    condition: selection and not filter_main
falsepositives:
    - Other legitimate binaries named "thor.exe" that aren't published by Nextron Systems
level: high

Original YAML and metadata in JSON

False positives

• Other legitimate binaries named "thor.exe" that aren't published by Nextron Systems

Source references

• Internal Research (source note; no public URL supplied)