OilRig APT Activity Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•26

This rule detects activity associated with the OilRig APT group, as detailed in Nyotron's March 2018 report. Specifically, it looks for the creation of a scheduled task named 'SC Scheduled Scan' that executes 'autoit3.exe' from a specific path, execution of executables within a ' Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.