Query: detection rule: Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity
Matching passage: Sigma rule: Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity. Logsource: windows / process_creation. Rule: title: Uncommon FileSystem Load Attempt By Format.com id: 9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60 status: test description: 'Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs. ' references: - https://twitter.com/0gtweet/status/1477925112561209344 - https://twitter.com/wdormann/status/1478011052130459653?s=20 author: Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2024-05-13 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: \format.com CommandLine|contains: '/fs:' filter_main_known_fs: CommandLine|contains: - /fs:exFAT - /fs:FAT - /fs:NTFS - /fs:ReFS - /fs:UDF condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW. Logsource: windows / file_event. Rule: title: Files With System Process Name In Unsuspected Locations id: d5866ddf-ce8f-4aea-b28e-d96485a20d3d status: test description: 'Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production. ' references: - Internal Research author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2020-05-26 modified: 2026-07-28 tags: - attack.stealth - attack.t1036.005 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \AtBroker.exe - \audiodg.exe - \backgroundTaskHost.exe - \bcdedit.exe - \bitsadmin.exe - \cmdl32.exe - \cmstp.exe - \conhost.exe - \csrss.exe - \dasHost.exe - \dfrgui.exe - \dllhost.exe - \dwm.exe - \eventcreate.exe - \eventvwr.exe - \explorer.exe - \extrac32.exe - \fontdrvhost.exe - \fsquirt.exe - \ipconfig.exe - \iscsicli.exe - \iscsicpl.exe - \logman.exe - \LogonUI.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \msinfo32.exe - \mstsc.exe - \nbtstat.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regini.exe - \regsvr32.exe - \rundll32.exe - \RuntimeBroker.exe - \schtasks.exe - \SearchFilterHost.exe - \SearchIndexer.exe - \SearchProtocolHost.exe - \SecurityHealthService.exe - \SecurityHealthSystray.exe - \services.exe - \ShellAppRuntime.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \SystemSettingsBroker.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \TiWorker.exe - \vssadmin.exe - \w32tm.exe - \WerFault.exe - \WerFaultSecure.exe - \wermgr.exe - \wevtutil.exe - \wininit.exe - \winlogon.exe - \winrshost.exe - \WinRTNetMUAHostServer.exe - \wlanext.exe - \wlrmdr.exe - \WmiPrvSE.exe - \wslhost.exe - \WSReset.exe - \WUDFHost.exe - \WWAHost.exe filter_main_generic: TargetFilename|contains: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\Windows\uus\ filter_main_tiworker: Image|endswith: - \TiWorker.exe - \wuaucltcore.exe TargetFilename|startswith: C:\Windows\Temp\ filter_main_svchost: Image|endswith: - C:\Windows\system32\svchost.exe - C:\Windows\SysWOW64\svchost.exe TargetFilename|contains: - C:\Program Files\WindowsApps\ - C:\Program Files (x86)\WindowsApps\ - \AppData\Local\Microsoft\WindowsApps\ filter_main_wuauclt: Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\Sy