Query: rule covering Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a fil
Matching passage: Sigma rule: Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a fil. Logsource: windows / appxdeployment-server. Rule: title: Remote AppX Package Downloaded from File Sharing or CDN Domain id: 8b48ad89-10d8-4382-a546-50588c410f0d related: - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: 'Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain. ' references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2026-03-29 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: 854 Path|contains: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudflare.com - ufile.io - w3spaces.com - workers.dev - x0.at condition: selection falsepositives: - Unlikely, unless the organization uses file sharing or CDN services to distribute internal applications. level: high
Near-miss passage: Sigma rule: Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal. Logsource: windows / ps_script. Rule: title: Automated Collection Bookmarks Using Get-ChildItem PowerShell id: e0565f5d-d420-4e02-8a68-ac00d864f9cf status: test description: 'Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md author: frack113 date: 2021-12-13 modified: 2022-12-25 tags: - attack.discovery - attack.t1217 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-ChildItem - ' -Recurse ' - ' -Path ' - ' -Filter Bookmarks' - ' -ErrorAction SilentlyContinue' - ' -Force' condition: selection falsepositives: - Unknown level: low