threatpost.com

filescan.io

olivierlanglois.net

marclacroixlanglois@laposte.net

regsvr32.exe

nghiru.exe

c:\windows\system32\oealmot\auqznoxmif.dll

explorer.exe

c:\windows\system32\regsvr32.exe

advapi32.dll

kernel32.dll

oleaut32.dll

user32.dll

comctl32.dll

bccc6d71afc053a5af18142c4926be98

bf757fc27bc718f99334d289d95394a7d4db443a23fd61a4731a00bb5bd8d4a7

T1564.003

T1057

https://threatpost.com/cybercriminals-windows-utility-regsvr32-malware/178333

http://www.amazon.com/exec/obidos/redirect?link_code=ur2&tag=olivielanglos-20&camp=1789&creative=9325&path=http://www.amaz

https://community.rsa.com/community/products/netwitness/blog/2016/04/26/detection-of-com-whitelist-bypassing-with-ecat

HKEY_CLASSES_ROOT\ocxfile\AutoRegister

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser

rule RSA_IR_Windows_COM_bypass_script {
	meta:
		author = "RSA IR"
		Date = "22 Apr 2016"
		reference = "https://community.rsa.com/community/products/netwitness/blog/2016/04/26/detection-of-com-whitelist-bypassing-with-ecat"
		comment1 = "Detects potential scripts used by COM+ Whitelist Bypass"
		comment2 = "More information on bypass located at: http://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html"
	strings:
		$s1 = "<scriptlet>" nocase
		$s2 = "<registration" nocase
		$s3 = "classid=" nocase
		$s4 = "[CDATA[" nocase
		$s5 = "</script>" nocase
		$s6 = "</registration>" nocase
		$s7 = "</scriptlet>" nocase
	condition:
		all of ($s*)
}