Query: Sigma rule for Download and compress a remote file and store it in a cab file on local machine.
Matching passage: Sigma rule: Download and compress a remote file and store it in a cab file on local machine.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Download and Compress Into a CAB File id: 185d7418-f250-42d0-b72e-0c8b70661e93 status: test description: Download and compress a remote file and store it in a cab file on local machine. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-08-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - ' \\\\' - .cab condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uncommon processes creating remote threads.. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation By Uncommon Source Image id: 66d31e5f-52d6-40a4-9615-002d3789a119 related: - id: 02d1d718-dd13-41af-989d-ea85c7fab93f type: derived status: test description: Detects uncommon processes creating remote threads. references: - Personal research, statistical analysis - https://lolbas-project.github.io author: Perez Diego (@darkquassar), oscd.community date: 2019-10-27 modified: 2025-07-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \explorer.exe - \iexplore.exe - \msiexec.exe - \powerpnt.exe - \schtasks.exe - \winlogon.exe filter_main_winlogon_1: SourceImage: C:\Windows\System32\winlogon.exe TargetImage: - C:\Windows\System32\services.exe - C:\Windows\System32\wininit.exe - C:\Windows\System32\csrss.exe - C:\Windows\System32\LogonUI.exe - C:\Windows\System32\wlrmdr.exe - C:\Windows\System32\AtBroker.exe - C:\Windows\System32\dwm.exe - C:\Windows\System32\fontdrvhost.exe - C:\Windows\System32\userinit.exe filter_main_winlogon_2: SourceImage: C:\Windows\System32\winlogon.exe TargetParentProcessId: 4 filter_main_schtasks_conhost: SourceImage: - C:\Windows\System32\schtasks.exe - C:\Windows\SysWOW64\schtasks.exe TargetImage: C:\Windows\System32\conhost.exe filter_main_explorer: SourceImage: C:\Windows\explorer.exe TargetImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ filter_main_system: TargetImage: System filter_main_msiexec_1: SourceImage|endswith: \msiexec.exe TargetImage|contains: - \AppData\Local\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\Microsoft.NET\Framework64\ filter_main_msiexec_2: SourceImage|endswith: \msiexec.exe TargetImage: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_iexplore: SourceImage: C:\Program Files\Internet Explorer\iexplore.exe TargetImage: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Windows\System32\rundll32.exe filter_main_powerpnt: SourceImage|endswith: \POWERPNT.EXE TargetImage|contains: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ filter_optional_aurora_smartconsole1: SourceImage: C:\Program Files\internet explorer\iexplore.exe SourceCommandLine|contains|all: - https:// - .checkpoint.com/documents/ - SmartConsole_OLH/ - default.htm#cshid= filter_optional_aurora_smartconsole2: SourceImage: C:\Program Files\internet