Blue Mockingbird - Registry

Title: Blue Mockingbird - Registry
Status: test
Description:Attempts to detect system changes made by Blue Mockingbird
References:
  -https://redcanary.com/blog/blue-mockingbird-cryptominer/
Author: Trent Liffick (@tliffick)
Date: 2020-05-14
modified:2023-08-17
Tags:

• -'attack.defense-evasion'
• -'attack.execution'
• -'attack.persistence'
• -'attack.t1112'
• -'attack.t1047'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject|endswith: '\CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll'
  condition:selection
Falsepositives:
  -Unknown
Level: high