
title: Suspicious VHD Image Download From Browser
author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
date: 2021/10/25
description: Malware can use mountable Virtual Hard Disk .vhd file to encapsulate
  payloads and evade security controls
detection:
  SELECTION_1:
    EventID: 11
  SELECTION_2:
    Image:
    - '*chrome.exe'
    - '*firefox.exe'
    - '*microsoftedge.exe'
    - '*microsoftedgecp.exe'
    - '*msedge.exe'
    - '*iexplorer.exe'
    - '*brave.exe'
    - '*opera.exe'
  SELECTION_3:
    TargetFilename: '*.vhd*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Legitimate user creation
id: 8468111a-ef07-4654-903b-b863a80bbc95
level: medium
logsource:
  category: file_event
  definition: in sysmon add "<TargetFilename condition="end with">.vhd</TargetFilename>
    <!--vhd files for ZLoader and lazarus malware vectors -->"
  product: windows
modified: 2021/10/29
references:
- https://redcanary.com/blog/intelligence-insights-october-2021/
- https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/
- https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
status: test
tags:
- attack.resource_development
- attack.t1587.001
ruletype: SIGMA
