Smoke Sandstorm - SnailResin and SlugResin Infection Detection
Nf Ttp Smoke Sandstorm Unusual Coreuicomponentdll Behaviour
Query
let malware = datatable (name:string)["Trojan:Win64/SnailResin","Backdoor:Win64/SlugResin","Trojan:Win32/BassBreaker"];
AlertInfo
| join AlertEvidence on AlertId
| extend Malware = tostring(parse_json(AdditionalFields).Name)
| where ( EntityType =~ "Malware" ) and isnotempty(Malware) and Malware has_any(malware)About this query
Explanation
The query is designed to detect the presence of the Smoke Sandstorm threat group's SnailResin and SlugResin infections, which involve the use of DLL search order hijacking to execute malicious code. The query looks for unusual behavior related to the CoreUIComponent.dll file and checks for specific alerts related to DLL hijacking and the Smoke Sandstorm activity group. It also searches for alerts in Microsoft Defender for Endpoint that indicate the presence of the SnailResin and SlugResin malware. The purpose of this query is to identify and mitigate the risk of stealthy execution of malicious code through DLL hijacking.