HackTool - Htran/NATBypass Execution

Title: HackTool - Htran/NATBypass Execution
Status: test
Description:Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)
References:
  -https://github.com/HiwinCN/HTran
  -https://github.com/cw1997/NATBypass
Author: Florian Roth (Nextron Systems)
Date: 2022-12-27
modified:2023-02-04
Tags:

• -'attack.command-and-control'
• -'attack.t1090'
• -'attack.s0040'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    Image|endswith:
      -'\htran.exe'
      -'\lcx.exe'

  selection_cli:
    CommandLine|contains:
      -'.exe -tran '
      -'.exe -slave '

  condition:1 of selection_*
Falsepositives:
  -Unknown
Level: high