Query: Sigma YAML for windows / file_change
Matching passage: Sigma rule: Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or othe. Logsource: windows / file_change. Rule: title: Unusual File Modification by dns.exe id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3 related: - id: 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0 type: similar status: test description: Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed) references: - https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-27 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: file_change product: windows detection: selection: Image|endswith: \dns.exe filter: TargetFilename|endswith: \dns.log condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may. Logsource: windows / process_creation. Rule: title: Script Interpreter Execution From Suspicious Folder id: 1228c958-e64e-4e71-92ad-7d429f4138ba status: test description: 'Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts. ' references: - https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military - https://learn.microsoft.com/en-us/windows/win32/shell/csidl author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-08 modified: 2026-02-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_proc_image: Image|endswith: - \cscript.exe - \mshta.exe - \wscript.exe selection_proc_flags: CommandLine|contains: - ' -ep bypass ' - ' -ExecutionPolicy bypass ' - ' -w hidden ' - '/e:javascript ' - '/e:Jscript ' - '/e:vbscript ' selection_proc_original: OriginalFileName: - cscript.exe - mshta.exe - wscript.exe selection_folders_1: CommandLine|contains: - :\Perflogs\ - :\Users\Public\ - \%Public% - \AppData\Local\Temp - \AppData\Roaming\Temp - \Temporary Internet - \Windows\Temp - \Start Menu\Programs\Startup\ - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' selection_folders_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ - CommandLine|contains|all: - :\Users\ - \Documents\ - CommandLine|contains|all: - :\Users\ - \Music\ - CommandLine|contains|all: - :\Users\ - \Pictures\ - CommandLine|contains|all: - :\Users\ - \Videos\ filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: 1 of selection_proc_* and 1 of selection_folders_* and not 1 of filter_optional_* falsepositives: - Various legitimate software have been observed to use similar techniques for installation or update purposes;thus, it is recommended to review and tune filters for your environme