Fog

钓鱼（Pay Adjustment.zip → LNK → PowerShell）/ 漏洞利用（SonicWall/Veeam）/ IAB
    ↓
stage1.ps1（隐藏窗口下载执行）
    ↓
ktool.exe + iQVW64.sys（BYOVD 提权至 SYSTEM）
    ↓
GC2 / Adaptix / Sliver C2（多框架持久化）
    ↓
Syteca 屏幕录制 + BloodHound AD 枚举
    ↓
Pass-the-Hash / PsExec / SMBExec（横向移动）
    ↓
DonPAPI / Impacket / Certipy（凭证窃取）
    ↓
7-zip 压缩 → FreeFileSync/MegaSync → Mega 云存储外传
    ↓
lootsubmit.ps1 / trackerjacker.ps1（系统信息回传）
    ↓
vssadmin 删除卷影副本
    ↓
Fog 载荷（AES + RSA 加密 → .FOG/.FLOCKED + Monero 支付）

title: Fog Ransomware - BYOVD Privilege Escalation via iQVW64
id: fog001-byovd
status: experimental
description: 检测 Fog 使用 ktool.exe + iQVW64.sys 进行 BYOVD 提权
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\ktool.exe'
  condition: selection
level: critical
tags:
  - attack.privilege_escalation
  - attack.t1068

title: Fog Ransomware - Fake Security Service Creation
id: fog002-fake-service
status: experimental
description: 检测 Fog 创建伪装为安全服务的持久化服务
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - 'sc create'
      - 'SecurityHealthIron'
  condition: selection
level: critical
tags:
  - attack.persistence
  - attack.t1543

title: Fog Ransomware - Phishing PowerShell Download Cradle
id: fog003-phishing-ps
status: experimental
description: 检测 Fog 钓鱼邮件触发的 PowerShell 下载执行行为
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - 'powershell'
      - 'WindowStyle Hidden'
      - 'NoProfile'
      - 'netlify.app'
      - 'IEX'
  condition: selection
level: critical
tags:
  - attack.execution
  - attack.t1059.001

rule Fog_Ransomware {
    meta:
        description = "检测 Fog 勒索软件载荷"
        author = "Threat Intelligence Team"
        date = "2026-07-01"
        reference = "Fog ransomware with DOGE political content"
    strings:
        $s1 = ".FOG" ascii
        $s2 = ".FLOCKED" ascii
        $s3 = "readme.txt" ascii
        $s4 = "RANSOMNOTE.txt" ascii
        $s5 = "SecurityHealthIron" ascii
        $s6 = "ktool.exe" ascii
        $s7 = "iQVW64.sys" ascii
        $hex1 = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 }
    condition:
        3 of ($s*) and $hex1
}