Query: detect Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known fold in logs
Matching passage: Sigma rule: Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known fold. Logsource: windows / appxdeployment-server. Rule: title: AppX Located in Known Staging Directory Added to Deployment Pipeline id: 5cdeaf3d-1489-477c-95ab-c318559fc051 status: test description: 'Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory. ' references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection_eid: EventID: 854 selection_paths_forward: Path|contains: - :/Perflogs/ - :/Users/Public/ - :/Windows/Temp/ - /AppdData/Local/Temp/ - /Desktop/ - /Downloads/ selection_paths_back: Path|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \AppdData\Local\Temp\ - \Desktop\ - \Downloads\ condition: selection_eid and 1 of selection_paths_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google. Logsource: windows / network_connection. Rule: title: Suspicious Non-Browser Network Communication With Google API id: 7e9cf7b6-e827-11ed-a05b-0242ac120003 status: experimental description: 'Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet) ' references: - https://github.com/looCiprian/GC2-sheet - https://youtu.be/n2dFlSaBBKo - https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf - https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/ - https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/ author: Gavin Knapp date: 2023-05-01 modified: 2025-02-22 tags: - attack.command-and-control - attack.t1102 logsource: product: windows category: network_connection detection: selection: DestinationHostname|contains: - drive.googleapis.com - oauth2.googleapis.com - sheets.googleapis.com - www.googleapis.com filter_optional_brave: Image|endswith: \brave.exe filter_optional_chrome: Image|endswith: - :\Program Files\Google\Chrome\Application\chrome.exe - :\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_google_drive: Image|contains: :\Program Files\Google\Drive File Stream\ Image|endswith: \GoogleDriveFS.exe filter_optional_firefox: Image|endswith: - :\Program Files\Mozilla Firefox\firefox.exe - :\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image|endswith: - :\Program Files (x86)\Internet Explorer\iexplore.exe - :\Program Files\Internet Explorer\iexplore.exe filter_optional_maxthon: Image|endswith: \maxthon.exe filter_optional_edge_1: - Image|contains: :\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: - :\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - :\Program Files\Microsoft\Edge\Application\msedge.exe - \WindowsApps\MicrosoftEdge.exe filter_optional_edge_2: Image|contains: - :\Program Files (x86)\Microsoft\EdgeCore\ - :\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_opera: Image|endswith: \opera.exe filter_optional_safari: Image|endswith: \safari.exe filter_optional_seamonkey: Image|endswith: \seamonkey.exe filter_optional_vivaldi: Image|endswith: \vivaldi.exe filter_optional_whale: Image|endswith: \whale.exe filter_optional_googleupdate: Image|endswith: \GoogleUpdate.exe filter_optional_outlook_exe: Image|endswith: \outlook.exe filter_main_null: Image: nul