Detections

Analysis of One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement

Nation-State Espionage Malicious LNK and Document Loader

sigma · generated; parse required before publication

title: Nation-State Espionage Malicious LNK and Document Loader
description: Detects malicious shortcut files (.lnk) executing mshta or certutil to
  download espionage implants.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    Image: '*\mshta.exe'
    CommandLine: '*http*//*.hta*'
  condition: selection
level: medium
tags: []
references: []

APT_LNK_Espionage_Loader

yara · compile required before publication

rule APT_LNK_Espionage_Loader {
  strings:
    $s1 = "Law_Enforcement_Briefing_LNK" ascii wide nocase
    $s2 = "mshta.exe http://" ascii wide nocase
    $s3 = "CERTUTIL_DECODE_CERT_B64" ascii wide nocase
  condition:
    any of them
}