Silence.EDA Detection

Title: Silence.EDA Detection
Status: test
Description:Detects Silence EmpireDNSAgent as described in the Group-IP report
References:
  -https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
Author: Alina Stepchenkova, Group-IB, oscd.community
Date: 2019-11-01
modified:2023-04-03
Tags:

• -'attack.execution'
• -'attack.t1059.001'
• -'attack.command-and-control'
• -'attack.t1071.004'
• -'attack.t1572'
• -'attack.impact'
• -'attack.t1529'
• -'attack.g0091'
• -'attack.s0363'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  empire:
    ScriptBlockText|contains|all:
      -'System.Diagnostics.Process'
      -'Stop-Computer'
      -'Restart-Computer'
      -'Exception in execution'
      -'$cmdargs'
      -'Close-Dnscat2Tunnel'

  dnscat:
    ScriptBlockText|contains|all:
      -'set type=$LookupType`nserver'
      -'$Command | nslookup 2>&1 | Out-String'
      -'New-RandomDNSField'
      -'[Convert]::ToString($SYNOptions, 16)'
      -'$Session.Dead = $True'
      -'$Session["Driver"] -eq'

  condition:empire and dnscat
Falsepositives:
  -Unknown
Level: critical