Query: Sigma YAML for windows / file_delete
Matching passage: Sigma rule: Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass. Logsource: windows / file_delete. Rule: title: ADS Zone.Identifier Deleted By Uncommon Application id: 3109530e-ab47-4cc6-a953-cac5ebcc93ae related: - id: 7eac0a16-5832-4e81-865f-0268a6d19e4b type: similar status: test description: Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps. references: - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-04 modified: 2025-07-04 tags: - attack.stealth - attack.t1070.004 logsource: product: windows category: file_delete detection: selection: TargetFilename|endswith: :Zone.Identifier filter_main_generic: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\explorer.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\explorer.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_optional_browsers_chrome: Image: - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_browsers_firefox: Image: - C:\Program Files (x86)\Mozilla Firefox\firefox.exe - C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_browsers_msedge: Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other third party applications not listed. level: medium
Near-miss passage: Sigma rule: Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load. Logsource: linux / auditd. Rule: title: System Info Discovery via Sysinfo Syscall id: b207d563-a1d9-4275-b349-77d1eb55aa6d status: experimental description: 'Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it''s a viable target. ' references: - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md - https://man7.org/linux/man-pages/man2/sysinfo.2.html author: Milad Cheraghi date: 2025-05-30 modified: 2025-12-05 tags: - attack.discovery - attack.t1057 - attack.t1082 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall ' detection: selection: type: SYSCALL SYSCALL: sysinfo filter_optional_splunk: exe|endswith: /bin/splunkd condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate administrative activity level: low