Registry Entries For Azorult Malware

Title: Registry Entries For Azorult Malware
Status: test
Description:Detects the presence of a registry key created during Azorult execution
References:
  -https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a
Author: Trent Liffick
Date: 2020-05-08
modified:2021-11-27
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• product: windows
• category: registry_event

Detection:
  selection:
    EventID:
      -'12'
      -'13'

    TargetObject|contains: 'SYSTEM\'
    TargetObject|endswith: '\services\localNETService'
  condition:selection
Falsepositives:
  -Unknown
Level: critical