Turla Kazuar v3 Data Exfiltration
Detects data exfiltration activity by Turla's Kazuar v3 loader. After performing system reconnaissance, the VBScript loader sends collected information to the C2 server via HTTP POST requests. The exfiltration process collects system information including OS version, boot time, processor architecture, computer name, username, domain, running processes, and file listings, formats the data as plain text, and sends it via HTTP POST to the requestor.php endpoint on the C2 server. The loader uses WinHttp.WinHttpRequest.5.1 with SSL certificate validation disabled and sets User-Agent to "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)" to appear as legitimate browser traffic. The requestor.php endpoint is a specific indicator of Kazuar v3 C2 communication. This rule detects POST requests to this endpoint targeting any internet-routable IPv4 address, as Turla may use different C2 servers across campaigns. The combination of the specific endpoint name and POST method is a strong indicator of Kazuar v3 data exfiltration.
Sigma
