Potential PlugX Activity

detection:
  filter_cammute:
    Image|contains:
      - '\Lenovo\Communication Utility\'
      - '\Lenovo\Communications Utility\'
  filter_chrome_frame:
    Image|contains: '\Google\Chrome\application\'
  filter_devemu:
    Image|contains: '\Microsoft Device Emulator\'
  filter_gadget:
    Image|contains: '\Windows Media Player\'
  filter_hcc:
    Image|contains: '\HTML Help Workshop\'
  filter_hkcmd:
    Image|contains:
      - '\System32\'
      - '\SysNative\'
      - '\SysWow64\'
  filter_mc:
    Image|contains:
      - '\Microsoft Visual Studio'
      - '\Microsoft SDK'
      - '\Windows Kit'
  filter_msmpeng:
    Image|contains:
      - '\Microsoft Security Client\'
      - '\Windows Defender\'
      - '\AntiMalware\'
  filter_msseces:
    Image|contains:
      - '\Microsoft Security Center\'
      - '\Microsoft Security Client\'
      - '\Microsoft Security Essentials\'
  filter_oinfo:
    Image|contains: '\Common Files\Microsoft Shared\'
  filter_oleview:
    Image|contains:
      - '\Microsoft Visual Studio'
      - '\Microsoft SDK'
      - '\Windows Kit'
      - '\Windows Resource Kit\'
  filter_rc:
    Image|contains:
      - '\Microsoft Visual Studio'
      - '\Microsoft SDK'
      - '\Windows Kit'
      - '\Windows Resource Kit\'
      - '\Microsoft.NET\'
  selection_cammute:
    Image|endswith: '\CamMute.exe'
  selection_chrome_frame:
    Image|endswith: '\chrome_frame_helper.exe'
  selection_devemu:
    Image|endswith: '\dvcemumanager.exe'
  selection_gadget:
    Image|endswith: '\Gadget.exe'
  selection_hcc:
    Image|endswith: '\hcc.exe'
  selection_hkcmd:
    Image|endswith: '\hkcmd.exe'
  selection_mc:
    Image|endswith: '\Mc.exe'
  selection_msmpeng:
    Image|endswith: '\MsMpEng.exe'
  selection_msseces:
    Image|endswith: '\msseces.exe'
  selection_oinfo:
    Image|endswith: '\OInfoP11.exe'
  selection_oleview:
    Image|endswith: '\OleView.exe'
  selection_rc:
    Image|endswith: '\rc.exe'
  condition: ( selection_cammute and not filter_cammute ) or ( selection_chrome_frame and not filter_chrome_frame ) or ( selection_devemu and not filter_devemu ) or ( selection_gadget and not filter_gadget ) or ( selection_hcc and not filter_hcc ) or ( selection_hkcmd and not filter_hkcmd ) or ( selection_mc and not filter_mc ) or ( selection_msmpeng and not filter_msmpeng ) or ( selection_msseces and not filter_msseces ) or ( selection_oinfo and not filter_oinfo ) or ( selection_oleview and not filter_oleview ) or ( selection_rc and not filter_rc )

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Florian Roth (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

None of the everyday examples and documented commands on CmdID’s program pages trips it. To see whether a command line does, paste it into CmdID.