Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious. Logsource: windows / file_event. Rule: title: Suspicious Deno File Written from Remote Source id: 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e status: experimental description: 'Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it''s own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno. ' references: - https://taggart-tech.com/evildeno/ author: Josh Nickels, Michael Taggart date: 2025-05-22 tags: - attack.execution - attack.t1204 - attack.t1059.007 - attack.command-and-control - attack.t1105 logsource: category: file_event product: windows detection: selection_path: TargetFilename|contains: - \deno\gen\ - \deno\remote\https\ TargetFilename|contains|all: - :\Users\ - \AppData\ condition: selection_path falsepositives: - Legitimate usage of deno to request a file or bring a DLL to a host level: low
Near-miss passage: Sigma rule: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disab. Logsource: windows / process_creation. Rule: title: Suspicious Manipulation Of Default Accounts Via Net.EXE id: 5b768e71-86f2-4879-b448-81061cbae951 status: test description: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc references: - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-21 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_user_option: CommandLine|contains: ' user ' selection_username: CommandLine|contains: - ' Järjestelmänvalvoja ' - ' Rendszergazda ' - ' Администратор ' - ' Administrateur ' - ' Administrador ' - ' Administratör ' - ' Administrator ' - ' guest ' - ' DefaultAccount ' - ' "Järjestelmänvalvoja" ' - ' "Rendszergazda" ' - ' "Администратор" ' - ' "Administrateur" ' - ' "Administrador" ' - ' "Administratör" ' - ' "Administrator" ' - ' "guest" ' - ' "DefaultAccount" ' - ' ''Järjestelmänvalvoja'' ' - ' ''Rendszergazda'' ' - ' ''Администратор'' ' - ' ''Administrateur'' ' - ' ''Administrador'' ' - ' ''Administratör'' ' - ' ''Administrator'' ' - ' ''guest'' ' - ' ''DefaultAccount'' ' filter: CommandLine|contains|all: - guest - /active no condition: all of selection_* and not filter falsepositives: - Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium level: high