Query: Sigma rule for Detects file creation events with filename patterns used by Impacket.
Matching passage: Sigma rule: Detects file creation events with filename patterns used by Impacket.. Logsource: windows / file_event. Rule: title: HackTool - Impacket File Indicators id: 03f4ca17-de95-428d-a75a-4ee78b047256 related: - id: 6e2a900a-ced9-4e4a-a9c2-13e706f9518a type: similar status: experimental description: Detects file creation events with filename patterns used by Impacket. references: - https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/ - https://github.com/fortra/impacket author: The DFIR Report, IrishDeath date: 2025-05-19 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection_names_re: TargetFilename|re: \\sessionresume_[a-zA-Z]{8}$ condition: selection_names_re falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious new RUN key element pointing to an executable in a suspicious folder. Logsource: windows / registry_set. Rule: title: New RUN Key Pointing to Suspicious Folder id: 02ee49e2-e294-4d0f-9278-f5b3212fc588 status: experimental description: Detects suspicious new RUN key element pointing to an executable in a suspicious folder references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2018-08-25 modified: 2025-10-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run selection_suspicious_paths_1: Details|contains: - :\Perflogs - :\ProgramData' - :\Windows\Temp - :\Temp - \AppData\Local\Temp - \AppData\Roaming - :\$Recycle.bin - :\Users\Default - :\Users\public - '%temp%' - '%tmp%' - '%Public%' - '%AppData%' selection_suspicious_paths_user_1: Details|contains: :\Users\ selection_suspicious_paths_user_2: Details|contains: - \Favorites - \Favourites - \Contacts - \Music - \Pictures - \Documents - \Photos filter_main_windows_update: TargetObject|contains: \Microsoft\Windows\CurrentVersion\RunOnce\ Image|startswith: C:\Windows\SoftwareDistribution\Download\ Details|contains|all: - 'rundll32.exe ' - C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 Details|contains: - \AppData\Local\Temp\ - C:\Windows\Temp\ filter_optional_spotify: Image|endswith: - C:\Program Files\Spotify\Spotify.exe - C:\Program Files (x86)\Spotify\Spotify.exe - \AppData\Roaming\Spotify\Spotify.exe TargetObject|endswith: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify Details|endswith: Spotify.exe --autostart --minimized condition: selection_target and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_* )) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Software using weird folders for updates level: high