Potential COLDSTEEL RAT Windows User Creation

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.

Detection logic

selection

TargetObject|contains|all:
  - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-
  - \ProfileImagePath
Details|contains:
  - ANONYMOUS
  - _DomainUser_

Condition

selection

Raw YAML

title: Potential COLDSTEEL RAT Windows User Creation
id: 95214813-4c7a-4a50-921b-ee5c538e1d16
status: test
description: Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-02
modified: 2023-08-17
tags:
    - attack.persistence
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-'
            - '\ProfileImagePath'
        Details|contains:
            - 'ANONYMOUS'
            - '_DomainUser_'
    condition: selection
falsepositives:
    - Unknown
level: high

False positives

Unknown

References

https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf

Similar rules

Blackbyte Ransomware Registry

high

windows · Same logsource category (registry_set)

Blue Mockingbird - Registry

high

windows · Same logsource category (registry_set)

CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

high

windows · Same logsource category (registry_set)

Forest Blizzard APT - Custom Protocol Handler Creation

high

windows · Same logsource category (registry_set)