Query: detection rule: Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate
Matching passage: Sigma rule: Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate. Logsource: windows / file_event. Rule: title: EVTX Created In Uncommon Location id: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb status: test description: 'Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting. ' references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2024-03-26 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: file_event product: windows definition: 'Requirements: The ".evtx" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition="end with">.evtx<TargetFilename>' detection: selection: TargetFilename|endswith: .evtx filter_main_path: TargetFilename|startswith: C:\Windows\System32\winevt\Logs\ filter_main_baseimage: TargetFilename|startswith: C:\ProgramData\Microsoft\Windows\Containers\BaseImages\ TargetFilename|endswith: \Windows\System32\winevt\Logs\ condition: selection and not 1 of filter_main_* falsepositives: - Administrator or backup activity - An unknown bug seems to trigger the Windows "svchost" process to drop EVTX files in the "C:\Windows\Temp" directory in the form "<log_name">_<uuid>.evtx". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml
Near-miss passage: Sigma rule: Detects suspicious malformed user agent strings in proxy logs. Logsource: proxy. Rule: title: Suspicious User Agent id: 7195a772-4b3f-43a4-a210-6a003d65caa1 status: test description: Detects suspicious malformed user agent strings in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-10-31 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection1: c-useragent|startswith: - user-agent - 'Mozilla/3.0 ' - 'Mozilla/2.0 ' - 'Mozilla/1.0 ' - 'Mozilla ' - ' Mozilla/' - Mozila/ - Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol selection2: c-useragent|contains: - ' (compatible;MSIE ' - '.0;Windows NT ' - loader selection3: c-useragent: - _ - CertUtil URL Agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 - HTTPS - Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a - x - xxx falsepositives: - c-useragent: Mozilla/3.0 * Acrobat * - cs-host|endswith: - .acrobat.com - .adobe.com - .adobe.io condition: 1 of selection* and not falsepositives falsepositives: - Unknown level: high