
title: Judgement Panda Credential Access Activity
author: Florian Roth
date: 2019/02/21
description: Detects Russian group activity as described in Global Threat Report 2019
  by Crowdstrike
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_10:
    CommandLine: '*-snapshot*'
  SELECTION_11:
    CommandLine: '*""*'
  SELECTION_12:
    CommandLine: '*c:\users\\*'
  SELECTION_2:
    Image: '*\xcopy.exe'
  SELECTION_3:
    CommandLine: '*/S*'
  SELECTION_4:
    CommandLine: '*/E*'
  SELECTION_5:
    CommandLine: '*/C*'
  SELECTION_6:
    CommandLine: '*/Q*'
  SELECTION_7:
    CommandLine: '*/H*'
  SELECTION_8:
    CommandLine: '*\\\*'
  SELECTION_9:
    Image: '*\adexplorer.exe'
  condition: (SELECTION_1 and ((SELECTION_2 and SELECTION_3 and SELECTION_4 and SELECTION_5
    and SELECTION_6 and SELECTION_7 and SELECTION_8) or (SELECTION_9 and SELECTION_10
    and SELECTION_11 and SELECTION_12)))
falsepositives:
- unknown
id: b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee
level: critical
logsource:
  category: process_creation
  product: windows
modified: 2020/08/26
references:
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
status: experimental
tags:
- attack.credential_access
- attack.t1081
- attack.t1003
- attack.t1552.001
- attack.t1003.003
ruletype: SIGMA
