Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from. Logsource: windows / file_event. Rule: title: ISO File Created Within Temp Folders id: 2f9356ae-bf43-41b8-b858-4496d83b2acb status: test description: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022. references: - https://twitter.com/Sam0x90/status/1552011547974696960 - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image author: '@sam0x90' date: 2022-07-30 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_1: TargetFilename|contains|all: - \AppData\Local\Temp\ - .zip\ TargetFilename|endswith: .iso selection_2: TargetFilename|contains: \AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ TargetFilename|endswith: .iso condition: 1 of selection* falsepositives: - Potential FP by sysadmin opening a zip file containing a legitimate ISO file level: high
Near-miss passage: Sigma rule: Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential. Logsource: windows / image_load. Rule: title: CredUI.DLL Loaded By Uncommon Process id: 9ae01559-cf7e-4f8e-8e14-4c290a1b4784 status: test description: Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW". references: - https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password - https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa - https://github.com/S12cybersecurity/RDPCredentialStealer author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-20 modified: 2026-06-29 tags: - attack.credential-access - attack.collection - attack.t1056.002 logsource: category: image_load product: windows detection: selection: - ImageLoaded|endswith: - \credui.dll - \wincredui.dll - OriginalFileName: - credui.dll - wincredui.dll filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\SystemApps\ filter_main_full: Image: - C:\Windows\explorer.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\regedit.exe filter_optional_opera: Image|endswith: \opera_autoupdate.exe filter_optional_process_explorer: Image|endswith: - \procexp64.exe - \procexp64a.exe - \procexp.exe filter_optional_teams: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\Teams\ Image|endswith: \Teams.exe filter_optional_onedrive: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\OneDrive\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legitimate processes loading those DLLs in your environment. level: medium