SOC Prime Menace Bounty —  January 2023 Outcomes | Gen Tech

Menace Bounty Publications

The primary month of 2023 has introduced invaluable contributions from our Menace Bounty members of the worldwide cyber group. The SOC Prime crew acquired 626 guidelines for evaluation and evaluation submitted by our detection content material specialists. In consequence, 144 guidelines efficiently handed verification and have been revealed on the SOC Prime Platform for monetization, and these guidelines contributed considerably to collective cyber protection.

Discover detections

It is all the time a good suggestion to take part in discussions with the SOC Prime group on our Discord server and discuss your detection engineering experience and your Menace Bounty program actions.

We strongly encourage Menace Bounty members to observe the Program Phrases and Content material Necessities to get pleasure from probably the most streamlined expertise of releasing your detections for monetization on the SOC Prime platform. As well as, Menace Bounty members can observe the suggestions to enhance detection content material offered by our content material specialists throughout verification and, if relevant, apply the urged ones to their detections.

The essential technical requirement for sigma guidelines urged for publishing and monetization with Menace Bounty is that your Sigma rule needs to be behavioral risk detection content materialwhich suggests it’s essential establish and detect cyber threats by analyzing conduct patterns (refers to how a system or course of works, together with actions similar to creating information and processes and their interrelationships, altering registry keys, and setting of community connections, and so forth.), moderately than counting on particular indicators of compromise (IOCs) (IP addresses, file names, malware hashes, and different figuring out data), or meant to be triggered by alerts from different safety options. safety.

One other crucial requirement is that it should be a singular detection, that doesn’t violate the mental property rights of any third get together.

MAIN Menace Bounty Detection Guidelines

Suspicious processes and information to bypass MoTW [Mark-of-the-Web] by BlueNoroff Group (by way of process_creation) rule sigma risk looking by Aytek Aytemur detects a suspicious rundll32 course of, which runs marcoor.dll, a malicious file that’s related to BlueNoroff Group.

Doable BlueNoroff group execution when getting/executing payload by way of shortcut file (by way of process_creation) rule sigma risk looking by Nattatorn Chuensangarun detect suspicious BlueNoroff group exercise acquiring and executing a further payload of the script when the sufferer double-clicked the shortcut file.

Doable malicious Zoom software program installer execution exercise by way of instructions related to detection (by way of process_creation) rule sigma risk looking by emre oh detects execution instructions related to the malicious zoom installer. On this malware marketing campaign, the malicious installer ‘ZoomInstallerFull.exe’ executes IcedId Loader, ‘maker.dll’, utilizing rundll32.exe with the ‘init’ parameter.

Doable exploit try detection ‘CVE-2023-21752’ (by way of File_Event) rule sigma risk looking by Kyaw Pyiyt Htet (Mik0yan) detects creation of malicious information from tried exploitation of Home windows Backup Service Elevation of Privilege Vulnerability (CVE-2023-21752).

One other Kyaw rule can also be within the high 5 Menace Bounty guidelines of the month. Doable system shell session by way of CVE-2023-21752 Related command detection exploit (by way of CmdLine) Menace Searching Sigma detects the era of the ‘ntauthoritysystem’ shell session by an try to use the Home windows Backup Service elevation of privilege vulnerability – CVE-2023-21752.

primary authors

The Menace Bounty score is predicated on evaluation of distinctive SOC Prime consumer actions with the Menace Bounty guidelines detection code and doesn’t embrace feedback or content material opinions. The next authors scored highest for his or her Menace Bounty detections based mostly on evaluation of January 23 exercise:

Nattatorn Chuensangarun

osman demir

Sittikorn Sangrattanapitak

emir erdoğan

kaan yeniyol

The typical Menace Bounty payout for November is $1,418.

Code your CV in detection engineering and monetize your Blue Group abilities. ? Be a part of SOC Prime Menace Bounty now!