HoneyMyte CoolClient Execution and Persistence
The rule detects the execution and persistence mechanisms of the HoneyMyte CoolClient backdoor. It identifies specific command-line arguments used during execution (' install', ' work', ' passuac') when launched by particular parent processes (Sang.exe or Jarte.exe). It also looks for the creation of 'write.exe' as a child process originating from common data directories (ProgramData, AppData, Temp). Additionally, the rule identifies persistence mechanisms by searching for command lines related to 'media_updaten' (likely a service) or 'ComboxResetTask' (likely a scheduled task).
Sigma
