Query: detect A General detection for files being created in the Windows startup directory. This could be an indicator of persistence. in logs
Matching passage: Sigma rule: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.. Logsource: windows / file_event. Rule: title: Startup Folder File Write id: 2aa0a6b4-a865-495b-ab51-c28249537b75 related: - id: 28208707-fe31-437f-9a7f-4b1108b94d2e type: similar status: test description: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/12 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-12-03 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\StartUp filter_main_update: - Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\uus\ARM64\wuaucltcore.exe - TargetFilename|startswith: - C:\$WINDOWS.~BT\NewOS\ - C:\$WinREAgent\Scratch\Mount\ filter_optional_onenote: Image|endswith: \ONENOTE.EXE TargetFilename|endswith: \Send to OneNote.lnk condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate level: medium
Near-miss passage: Sigma rule: Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides. Logsource: macos / process_creation. Rule: title: System Information Discovery Via Sysctl - MacOS id: 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c status: test description: 'Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments. ' references: - https://www.loobins.io/binaries/sysctl/# - https://evasions.checkpoint.com/techniques/macos.html - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/ - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/ - https://objective-see.org/blog/blog_0x1E.html - https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior - https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior author: Pratinav Chandra date: 2024-05-27 tags: - attack.stealth - attack.t1497.001 - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /sysctl - CommandLine|contains: sysctl selection_cmd: CommandLine|contains: - hw. - kern. - machdep. condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium