Query: rule covering Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass
Matching passage: Sigma rule: Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass. Logsource: windows / file_delete. Rule: title: ADS Zone.Identifier Deleted By Uncommon Application id: 3109530e-ab47-4cc6-a953-cac5ebcc93ae related: - id: 7eac0a16-5832-4e81-865f-0268a6d19e4b type: similar status: test description: Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps. references: - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-04 modified: 2025-07-04 tags: - attack.stealth - attack.t1070.004 logsource: product: windows category: file_delete detection: selection: TargetFilename|endswith: :Zone.Identifier filter_main_generic: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\explorer.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\explorer.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_optional_browsers_chrome: Image: - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_browsers_firefox: Image: - C:\Program Files (x86)\Mozilla Firefox\firefox.exe - C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_browsers_msedge: Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other third party applications not listed. level: medium
Near-miss passage: Sigma rule: Detects the removal or uninstallation of an application via "Wmic.EXE".. Logsource: windows / process_creation. Rule: title: Application Removed Via Wmic.EXE id: b53317a0-8acf-4fd1-8de8-a5401e776b96 related: - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 type: derived status: test description: Detects the removal or uninstallation of an application via "Wmic.EXE". references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-10---application-uninstall-using-wmic author: frack113 date: 2022-01-28 modified: 2024-07-02 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - call - uninstall condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: Application uninstall using WMIC technique: T1047 atomic_guid: c510d25b-1667-467d-8331-a56d3e9bc4ff regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_application/info.yml