Elastic Defend high stable eql

Potential PlugX Registry Modification

Identifies registry modification that matches on PlugX Trojan known registry configuration patterns such as C&C version, Run key persistence value and internet status on the victim machine. PlugX is a known RAT (Remote Access Trojan) malware family that is around since 2008 and is used as a backdoor to control the victim's machine fully.

View Source

Detection Logic

registry where

  /* PlugX store C&C server version in ms-pu sub values */
 registry.path : ("HK*\\Software\\CLASSES\\ms-pu\\PROXY*", "HK*\\Software\\CLASSES\\ms-pu\\CLSID*") or

  /* PlugX Persist via Run key with specific program args */
 (registry.path : "HK*\\CurrentVersion\\Run\\*" and
  not process.executable : ("?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\regedit.exe") and
  (registry.data.strings regex ".+exe. [0-9]{2,3}" or registry.data.strings : ("*.exe? -app", "*.exe? -net"))) or

  /* PlugX store internet status in Version value */
  (registry.path : "HK*\\System\\*ControlSet*\\Control\\Network\\Version" and registry.data.strings : "1")

Field Validations

Loading…

Comments (0)

Loading comments...