From 63c9bc97c3837acb6213a3c1ea682fa97962c4c4 Mon Sep 17 00:00:00 2001
From: Oddvar Moe <oddvar.moe@gmail.com>
Date: Thu, 3 Sep 2020 15:29:32 +0200
Subject: [PATCH] Added detection details on mpcmdrun

---
 yml/OSBinaries/MpCmdRun.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/yml/OSBinaries/MpCmdRun.yml b/yml/OSBinaries/MpCmdRun.yml
index 35cc106..630d802 100644
--- a/yml/OSBinaries/MpCmdRun.yml
+++ b/yml/OSBinaries/MpCmdRun.yml
@@ -29,10 +29,13 @@ Code_Sample:
 Detection: 
   - IOC: MpCmdRun storing data into alternate data streams.
   - IOC: MpCmdRun getting a file from a remote machine or the internet that is not expected.
+  - IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.
+  - IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log
 Resources:
   - Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus
   - Link: https://twitter.com/mohammadaskar2/status/1301263551638761477
   - Link: https://twitter.com/Oddvarmoe/status/1301444858910052352
+  - Link: https://twitter.com/NotMedic/status/1301506813242867720
 Acknowledgement:
   - Person: Askar
     Handle: '@mohammadaskar2'