Query: detect Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explore in logs
Matching passage: Sigma rule: Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explore. Logsource: windows / security. Rule: title: Windows Network Access Suspicious desktop.ini Action id: 35bc7e28-ee6b-492f-ab04-da58fcf6402e status: test description: Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk. references: - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/ author: Tim Shelton (HAWK.IO) date: 2021-12-06 modified: 2022-01-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.009 logsource: product: windows service: security detection: selection: EventID: 5145 ObjectType: File RelativeTargetName|endswith: \desktop.ini AccessList|contains: - WriteData - DELETE - WriteDAC - AppendData - AddSubdirectory condition: selection falsepositives: - Read only access list authority level: medium
Near-miss passage: Sigma rule: Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (. Logsource: dns. Rule: title: DNS Query to External Service Interaction Domains id: aff715fa-4dd5-497a-8db3-910bea555566 status: test description: "Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains.\nThese\ \ services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security\nresearchers and attackers\ \ alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and\nLog4Shell-style injections, where the exploit\ \ payload triggers an external DNS lookup to a controlled domain.\n\nA detection indicates that a host on your network resolved\ \ one of these domains, which may mean:\n (1) an attacker is actively probing or exploiting a vulnerable service and\ \ using the callback to\n confirm code execution or data exfiltration,\n (2) a security scanner (e.g. Nuclei, Gobies)\ \ is running against internal targets.\n\nInvestigate the source host, the full DNS query string (the unique subdomain prefix\ \ encodes the callback session),\nand any concurrent outbound connections or process activity to determine intent.\n" references: - https://twitter.com/breakersall/status/1533493587828260866 - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287 - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234 - https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve author: Florian Roth (Nextron Systems), Matt Kelly (list of domains) date: 2022-06-07 modified: 2026-07-23 tags: - attack.initial-access - attack.t1190 - attack.reconnaissance - attack.t1595.002 logsource: category: dns detection: selection: query|endswith: - .burpcollaborator.net - .canarytokens.com - .ceye.io - .ddns.1443.eu.org - .ddns.bypass.eu.org - .ddns.xn--gg8h.eu.org - .digimg.store - .dns.su18.org - .dnshook.site - .dnslog.cn - .dnslog.ink - .gobygo.net - .instances.httpworkbench.com - .interact.sh - .log.dnslog.pp.ua - .log.dnslog.qzz.io - .log.dnslogs.dpdns.org - .log.javaweb.org - .log.nat.cloudns.ph - .oast.fun - .oast.live - .oast.me - .oast.online - .oast.pro - .oast.site - .oastify.com - .p8.lol - .requestbin.net filter_main_polling: query|contains: polling.oastify.com condition: selection and not 1 of filter_main_* falsepositives: - Legitimate security scanning. level: high