Elastic Defend high stable eql

NetWire RAT Registry Modification

Identifies registry modification activity consistent with the NetWire Remote Access Trojan (RAT). NetWire is a publicly available, multi-platform RAT that is used by criminal and APT groups.

View Source

Detection Logic

registry where
   registry.path : (
      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\NetWire\\HostId",
      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\NetWire\\Install Date",
      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\NetWire\\HostId",
      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\NetWire\\Install Date"
      )

Field Validations

Loading…

Comments (0)

Loading comments...