Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.. Logsource: windows / file_event. Rule: title: Potential Homoglyph Attack Using Lookalike Characters in Filename id: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6 status: test description: 'Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters. ' references: - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish - http://www.irongeek.com/homoglyph-attack-generator.php author: Micah Babinski, @micahbabinski date: 2023-05-08 tags: - attack.stealth - attack.t1036 - attack.t1036.003 logsource: category: file_event product: windows detection: selection_upper: TargetFilename|contains: - А - В - Е - К - М - Н - О - Р - С - Т - Х - Ѕ - І - Ј - Ү - Ӏ - Ԍ - Ԛ - Ԝ - Α - Β - Ε - Ζ - Η - Ι - Κ - Μ - Ν - Ο - Ρ - Τ - Υ - Χ selection_lower: TargetFilename|contains: - а - е - о - р - с - х - ѕ - і - ӏ - ј - һ - ԁ - ԛ - ԝ - ο condition: 1 of selection_* falsepositives: - File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use. level: medium
Near-miss passage: Sigma rule: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or unde. Logsource: windows / process_creation. Rule: title: Suspicious Double Extension File Execution id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 related: - id: 5e6a80c8-2d45-4633-9ef4-fa2671a39c5c type: similar status: stable description: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns references: - https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html - https://twitter.com/blackorbird/status/1140519090961825792 - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) date: 2019-06-26 modified: 2025-05-30 tags: - attack.initial-access - attack.t1566.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - ' .exe' - ______.exe - .doc.exe - .doc.js - .docx.exe - .docx.js - .gif.exe - .jpeg.exe - .jpg.exe - .mkv.exe - .mov.exe - .mp3.exe - .mp4.exe - .pdf.exe - .pdf.js - .png.exe - .ppt.exe - .ppt.js - .pptx.exe - .pptx.js - .rtf.exe - .rtf.js - .svg.exe - .txt.exe - .txt.js - .xls.exe - .xls.js - .xlsx.exe - .xlsx.js - ⠀⠀⠀⠀⠀⠀.exe CommandLine|contains: - ' .exe' - ______.exe - .doc.exe - .doc.js - .docx.exe - .docx.js - .gif.exe - .jpeg.exe - .jpg.exe - .mkv.exe - .mov.exe - .mp3.exe - .mp4.exe - .pdf.exe - .pdf.js - .png.exe - .ppt.exe - .ppt.js - .pptx.exe - .pptx.js - .rtf.exe - .rtf.js - .svg.exe - .txt.exe - .txt.js - .xls.exe - .xls.js - .xlsx.exe - .xlsx.js - ⠀⠀⠀⠀⠀⠀.exe condition: selection falsepositives: - Unknown level: high