title: FlowCloud Malware
author: NVISO
date: 2020/06/09
description: Detects FlowCloud malware from threat group TA410.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject:
    - HKLM\HARDWARE\{804423C2-F490-4ac3-BFA5-13DEDE63A71A}
    - HKLM\HARDWARE\{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}
    - HKLM\HARDWARE\{2DB80286-1784-48b5-A751-B6ED1F490303}
  SELECTION_5:
    TargetObject:
    - HKLM\SYSTEM\Setup\PrintResponsor\\*
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and (SELECTION_4 or SELECTION_5))
falsepositives:
- Unknown
id: 5118765f-6657-4ddb-a487-d7bd673abbf1
level: critical
logsource:
  category: registry_event
  product: windows
modified: 2021/07/22
references:
- https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new
status: experimental
tags:
- attack.persistence
- attack.t1112
ruletype: SIGMA