Detections · Gootloader campaign uses SEO poisoning, Cobalt Strike, and SystemBC

Gootloader PowerShell and registry persistence

sigma · generated; parse required before publication

title: Gootloader PowerShell and registry persistence
description: Detects the documented PowerShell and registry-run-key behavior.
logsource:
  product: windows
detection:
  selection:
    process.command_line: powershell
    registry.key: CurrentVersion\Run
  condition: selection
level: high
tags:
- attack.t1059.001
- attack.t1547.001
references:
- https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/

Gootloader PowerShell and registry persistence SPL

spl · template

process.command_line="powershell" AND registry.key="CurrentVersion\\Run" | table process.command_line, registry.key

Gootloader PowerShell and registry persistence KQL

kql · template

TelemetryTable | where process.command_line="powershell" and registry.key="CurrentVersion\\Run" | project process.command_line, registry.key

gootloader_case_19530

yara · compile required before publication

rule gootloader_case_19530 {
  strings:
    $s1 = "WinHttpSvc" ascii wide nocase
    $s2 = "socks_powershell" ascii wide nocase
    $s3 = "91.92.136.20" ascii wide nocase
    $s4 = "49145e436aa571021bb1c7b727f8b049" ascii wide nocase
  condition:
    any of them
}