Query: rule covering Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored j
Matching passage: Sigma rule: Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored j. Logsource: antivirus. Rule: title: Antivirus - Relevant File Paths Alerts Signature id: c9a88268-0047-4824-ba6e-4d81ce0b907c status: test description: 'Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588 logsource: category: antivirus detection: selection_path: Filename|contains: - :\PerfLogs\ - :\Temp\ - :\Users\Default\ - :\Users\Public\ - :\Windows\ - /www/ - \inetpub\ - \tsclient\ - apache - nginx - tomcat - weblogic selection_ext: Filename|endswith: - .asax - .ashx - .asmx - .asp - .aspx - .bat - .cfm - .cgi - .chm - .cmd - .dat - .ear - .gif - .hta - .jpeg - .jpg - .jsp - .jspx - .lnk - .msc - .php - .pl - .png - .ps1 - .psm1 - .py - .pyc - .rb - .scf - .sct - .sh - .svg - .txt - .vbe - .vbs - .war - .wll - .wsf - .wsh - .xll - .xml condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active d. Logsource: windows / process_creation. Rule: title: Active Directory Database Snapshot Via ADExplorer id: 9212f354-7775-4e28-9c9f-8f0a4544e664 related: - id: ef61af62-bc74-4f58-b49b-626448227652 type: derived status: test description: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 modified: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \ADExp.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - OriginalFileName: AdExp - Description: Active Directory Editor - Product: Sysinternals ADExplorer selection_cli: CommandLine|contains: snapshot condition: all of selection_* falsepositives: - Unknown level: medium