Query: Sigma rule for Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is requi
Matching passage: Sigma rule: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is requi. Logsource: windows / raw_access_thread. Rule: title: Potential Defense Evasion Via Raw Disk Access By Uncommon Tools id: db809f10-56ce-4420-8c86-d6a7d793c79c status: test description: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2025-12-03 tags: - attack.stealth - attack.t1006 logsource: product: windows category: raw_access_thread detection: filter_main_floppy: Device|contains: floppy filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\CCM\ - C:\Windows\explorer.exe - C:\Windows\servicing\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemApps\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_main_system_images: Image: - Registry - System filter_main_windefender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: - \MsMpEng.exe - \MpDefenderCoreService.exe filter_main_microsoft_appdata: Image|startswith: C:\Users\ Image|contains|all: - \AppData\ - \Microsoft\ filter_main_ssd_nvme: Image|startswith: C:\Windows\Temp\ Image|endswith: - \Executables\SSDUpdate.exe - \HostMetadata\NVMEHostmetadata.exe filter_main_null: Image: null filter_main_systemsettings: Image: C:\Windows\ImmersiveControlPanel\SystemSettings.exe filter_main_update: Image|startswith: C:\$WinREAgent\Scratch\ filter_optional_github_desktop: Image|startswith: C:\Users\ Image|contains: \AppData\Local\GitHubDesktop\app- Image|endswith: \resources\app\git\mingw64\bin\git.exe filter_optional_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ Image|endswith: \thor.exe filter_optional_Keybase: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Keybase\upd.exe condition: not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 i. Logsource: linux / auditd. Rule: title: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall id: eca5e022-d368-4043-98e5-9736fb01f72f status: experimental description: 'Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally. ' references: - https://man7.org/linux/man-pages/man2/syslog.2.html - https://man7.org/linux/man-pages/man1/dmesg.1.html author: Milad Cheraghi date: 2025-05-27 modified: 2025-12-05 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs ' detection: selection: type: SYSCALL SYSCALL: syslog a0: - 4 - 5 - 6 condition: selection falsepositives: - System administrators or scripts that intentionally clear logs - Debugging scripts level: medium