initial

win_malware/armageddon_vbs_backdoor.yaml

@@ -0,0 +1,18 @@
+armageddon_vbs_backdoor:
+  query: 'SELECT f.filename, f.path, f.directory, st.name, st.action 
+FROM file f JOIN scheduled_tasks st ON st.action LIKE concat('%', concat(f.filename, '%')) 
+WHERE lower(f.directory) LIKE "%%\appdata\roaming\%" 
+  AND f.path LIKE "%.%%" 
+  AND lower(st.action) LIKE "%e:vbscript%" 
+  AND (SELECT COUNT(*) FROM file WHERE lower(directory) LIKE "%%\appdata\roaming\%" AND path LIKE "%.%%") >= 2;'
+  interval: 86400
+  snapshot: true
+  description: A backdoor associated with the Armageddon threat actor was installed on the system. Armageddon is a group notable for performing attacks on behalf of the Russian Federal Security Service (FSB). This backdoor is written in Visual Basic and serves to establish persistence on the system and then download & execute additional files on the system.
+  references:
+  - ref
+  mitre_tactics:
+  - Persistence: TA0003
+  mitre_techniques:
+  - Scheduled Task : T1053.005
+  platform:
+  - windows