Query: Sigma rule for Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files
Matching passage: Sigma rule: Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files. Logsource: windows / file_event. Rule: title: VHD Image Download Via Browser id: 8468111a-ef07-4654-903b-b863a80bbc95 status: test description: 'Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls. ' references: - https://redcanary.com/blog/intelligence-insights-october-2021/ - https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/ - https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/ author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2021-10-25 modified: 2023-05-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \firefox.exe - \iexplore.exe - \maxthon.exe - \MicrosoftEdge.exe - \msedge.exe - \msedgewebview2.exe - \opera.exe - \safari.exe - \seamonkey.exe - \vivaldi.exe - \whale.exe TargetFilename|contains: .vhd condition: selection falsepositives: - Legitimate downloads of ".vhd" files would also trigger this level: medium
Near-miss passage: Sigma rule: Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is. Logsource: windows / process_access. Rule: title: Potential Credential Dumping Activity Via LSASS id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da status: test description: 'Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature. ' references: - https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md - https://research.splunk.com/endpoint/windows_possible_credential_dumping/ author: Samir Bousseaden, Michael Haag date: 2019-04-03 modified: 2026-06-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess|contains: - '0x1038' - '0x1438' - '0x143a' - '0x1fffff' CallTrace|contains: - dbgcore.dll - dbghelp.dll - kernel32.dll - kernelbase.dll - ntdll.dll filter_main_system_user: SourceUser|contains: - AUTHORI - AUTORI filter_optional_thor: CallTrace|contains|all: - :\Windows\Temp\asgard2-agent\ - \thor\thor64.exe+ - '|UNKNOWN(' GrantedAccess: '0x103800' filter_optional_sysmon: SourceImage|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium