Query: alert when Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate
Matching passage: Sigma rule: Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate. Logsource: windows / file_event. Rule: title: EVTX Created In Uncommon Location id: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb status: test description: 'Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting. ' references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2024-03-26 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: file_event product: windows definition: 'Requirements: The ".evtx" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition="end with">.evtx<TargetFilename>' detection: selection: TargetFilename|endswith: .evtx filter_main_path: TargetFilename|startswith: C:\Windows\System32\winevt\Logs\ filter_main_baseimage: TargetFilename|startswith: C:\ProgramData\Microsoft\Windows\Containers\BaseImages\ TargetFilename|endswith: \Windows\System32\winevt\Logs\ condition: selection and not 1 of filter_main_* falsepositives: - Administrator or backup activity - An unknown bug seems to trigger the Windows "svchost" process to drop EVTX files in the "C:\Windows\Temp" directory in the form "<log_name">_<uuid>.evtx". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml
Near-miss passage: Sigma rule: Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process. Logsource: windows / process_creation. Rule: title: 7Zip Compressing Dump Files id: ec570e53-4c76-45a9-804d-dc3f355ff7a7 related: - id: 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc type: derived status: test description: Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration. references: - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-27 modified: 2026-06-05 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Description|contains: 7-Zip - Image|endswith: - \7z.exe - \7zr.exe - \7za.exe - OriginalFileName: - 7z.exe - 7za.exe - 7zr.exe selection_extension: CommandLine|contains: - .dmp - .dump - .hdmp condition: all of selection_* falsepositives: - Legitimate use of 7z with a command line in which ".dmp" or ".dump" appears accidentally - Legitimate use of 7z to compress WER ".dmp" files for troubleshooting level: medium