Sigma rule: Greenbug Espionage Group Indicators

Rule

Title

Greenbug Espionage Group Indicators

Status

test

Level

critical

Author

Florian Roth (Nextron Systems)

Date

2020-05-20

Modified

2023-03-09

File

rules-emerging-threats/2020/TA/Greenbug/proc_creation_win_apt_greenbug_may20.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Log source

product

windows

category

process_creation

Detection

selection_img:
    Image|endswith:
        - ':\ProgramData\adobe\Adobe.exe'
        - ':\ProgramData\oracle\local.exe'
        - '\revshell.exe'
        - '\infopagesbackup\ncat.exe'
        - ':\ProgramData\comms\comms.exe'
selection_msf:
    CommandLine|contains|all:
        - '-ExecutionPolicy Bypass -File'
        - '\msf.ps1'
selection_ncat:
    CommandLine|contains|all:
        - 'infopagesbackup'
        - '\ncat'
        - '-e cmd.exe'
selection_powershell:
    CommandLine|contains:
        - 'system.Data.SqlClient.SqlDataAdapter($cmd); [void]$da.fill'
        - '-nop -w hidden -c $k=new-object'
        - '[Net.CredentialCache]::DefaultCredentials;IEX '
        - ' -nop -w hidden -c $m=new-object net.webclient;$m'
        - '-noninteractive -executionpolicy bypass whoami'
        - '-noninteractive -executionpolicy bypass netstat -a'
selection_other:
    CommandLine|contains: 'L3NlcnZlcj1'  # base64 encoded '/server='
condition: 1 of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.stealth
• attack.g0049
• attack.execution
• attack.t1059.001
• attack.command-and-control
• attack.t1105
• attack.t1036.005
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• G0049
• T1036.005
• T1059.001
• T1105

References

• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2020/TA/Greenbug/proc_creation_win_apt_greenbug_may20.yml