Suspicious UltraVNC Execution

Title: Suspicious UltraVNC Execution
Status: test
Description:Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
References:
  -https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf
  -https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine
  -https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution
  -https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html
Author: Bhabesh Raj
Date: 2022-03-04
modified:2022-03-09
Tags:

• -'attack.lateral-movement'
• -'attack.g0047'
• -'attack.t1021.005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'-autoreconnect '
      -'-connect '
      -'-id:'

  condition:selection
Falsepositives:
  -Unknown
Level: high