Suspicious HWP Sub Processes

Title: Suspicious HWP Sub Processes
Status: test
Description:Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
References:
  -https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/
  -https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1
  -https://twitter.com/cyberwar_15/status/1187287262054076416
  -https://blog.alyac.co.kr/1901
  -https://en.wikipedia.org/wiki/Hangul_(word_processor)
Author: Florian Roth (Nextron Systems)
Date: 2019-10-24
modified:2021-11-27
Tags:

• -'attack.initial-access'
• -'attack.t1566.001'
• -'attack.execution'
• -'attack.t1203'
• -'attack.t1059.003'
• -'attack.g0032'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\Hwp.exe'
    Image|endswith: '\gbb.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high