
title: Turla PNG Dropper Service
author: Florian Roth
date: 2018/11/23
description: This method detects malicious services mentioned in Turla PNG dropper
  report by NCC Group in November 2018
detection:
  SELECTION_1:
    EventID: 7045
  SELECTION_2:
    ServiceName: WerFaultSvc
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- unlikely
id: 1228f8e2-7e79-4dea-b0ad-c91f1d5016c1
level: critical
logsource:
  product: windows
  service: system
references:
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/
status: experimental
tags:
- attack.persistence
- attack.g0010
- attack.t1050
- attack.t1543.003
ruletype: SIGMA
