Adwind RAT / JRAT File Artifact

Title: Adwind RAT / JRAT File Artifact
Status: test
Description:Detects javaw.exe in AppData folder as used by Adwind / JRAT
References:
  -https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
  -https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
Date: 2017-11-10
modified:2022-12-02
Tags:

• -'attack.execution'
• -'attack.t1059.005'
• -'attack.t1059.007'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    - TargetFilename|contains|all:
      - '\AppData\Roaming\Oracle\bin\java'
      - '.exe'
    - TargetFilename|contains|all:
      - '\Retrive'
      - '.vbs'
  condition:selection
Falsepositives:
Level: high