Octopus Scanner Malware

Title: Octopus Scanner Malware
Status: test
Description:Detects Octopus Scanner Malware.
References:
  -https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain
Author: NVISO
Date: 2020-06-09
modified:2021-11-27
Tags:

• -'attack.initial-access'
• -'attack.t1195'
• -'attack.t1195.001'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename|endswith:
      -'\AppData\Local\Microsoft\Cache134.dat'
      -'\AppData\Local\Microsoft\ExplorerSync.db'

  condition:selection
Falsepositives:
  -Unknown
Level: high