EvilNum APT Golden Chickens Deployment Via OCX Files

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the deployment of "Golden Chickens" malware, a method used by the Evilnum APT group. This rule specifically looks for the execution of 'regsvr32.exe' with specific command-line arguments that indicate the registration of an OCX file located in the user's AppData\Roaming directory. This technique is often used for defense evasion and persistence.