GitHub Repo

Inf Icedid

Date: 2021-07-29 ID: 1500f3aa-332a-496c-9f2a-9d7fbe8f7f03 Author: Teoderick Contreras Environment: attack_range Directory: inf_icedid

Description

Execution of icedid malware in attack range name.

MITRE ATT&CK Techniques

No MITRE techniques specified for this dataset.

Environment Details

Field Value
Environment attack_range
Directory inf_icedid
Test Date 2021-07-29

Datasets

The following datasets were collected during this attack simulation:

Windows-Sysmon

  • Path: /datasets/malware/icedid/inf_icedid/windows-sysmon.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

The following detections in our security content repository use this attack data for testing:

Detection Name Type Source MITRE ATT&CK Analytic Story
Rundll32 Create Remote Thread To A Process TTP Endpoint T1055 IcedID, Living Off The Land
Regsvr32 with Known Silent Switch Cmdline Anomaly Endpoint T1218.010 IcedID, Suspicious Regsvr32 Activity, Remcos, Living Off The Land, Qakbot, AsyncRAT
Suspicious Rundll32 PluginInit TTP Endpoint T1218.011 IcedID
Rundll32 Process Creating Exe Dll Files TTP Endpoint T1218.011 IcedID, Living Off The Land
Suspicious IcedID Rundll32 Cmdline TTP Endpoint T1218.011 IcedID, Living Off The Land
Rundll32 CreateRemoteThread In Browser TTP Endpoint T1055 IcedID, Living Off The Land
Rundll32 DNSQuery TTP Network T1218.011 IcedID, Living Off The Land

Usage Instructions

Replay with Splunk Attack Data

Replay attack data with replay.py from Splunk Attack Data.

1python replay.py --dataset /datasets/malware/icedid/inf_icedid/windows-sysmon.log --index attack_data

Manual Import

  1. Download the dataset files from the paths listed above
  2. Configure your Splunk instance with the appropriate sourcetypes
  3. Import the logs using the Splunk Add Data wizard

Related Content

Find more detections and analytics for this attack technique in our security content repository.

Source: GitHub | Version: 1.0