title: Emotet Process Creation
author: Florian Roth
date: 2019/09/30
description: Detects all Emotet like process executions that are not covered by the
  more generic rules
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine:
    - '* -e* PAA*'
    - '*JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ*'
    - '*QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA*'
    - '*kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA*'
    - '*IgAoACcAKgAnACkAOwAkA*'
    - '*IAKAAnACoAJwApADsAJA*'
    - '*iACgAJwAqACcAKQA7ACQA*'
    - '*JABGAGwAeAByAGgAYwBmAGQ*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Unlikely
fields:
- CommandLine
- ParentCommandLine
id: d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18
level: critical
logsource:
  category: process_creation
  product: windows
modified: 2020/09/01
references:
- https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/
- https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/
- https://app.any.run/tasks/97f875e8-0e08-4328-815f-055e971ba754/
- https://app.any.run/tasks/84fc9b4a-ea2b-47b1-8aa6-9014402dfb56/
status: experimental
tags:
- attack.execution
- attack.t1059.001
- attack.t1086
- attack.defense_evasion
- attack.t1027
ruletype: SIGMA