Query: detection rule: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign
Matching passage: Sigma rule: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign. Logsource: windows / file_event. Rule: title: OneNote Attachment File Dropped In Suspicious Location id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0 status: test description: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-09-19 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ - :\Temp\ TargetFilename|endswith: - .one - .onepkg filter_main_onenote: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \ONENOTE.EXE condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of ".one" or ".onepkg" files from those locations level: medium
Near-miss passage: Sigma rule: Detects suspicious user agent strings used by malware in proxy logs. Logsource: proxy. Rule: title: Malware User Agent id: 5c84856b-55a5-45f1-826f-13f37250cf4e status: test description: Detects suspicious user agent strings used by malware in proxy logs references: - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules - http://www.botopedia.org/search?searchword=scan&searchphrase=all - https://networkraptor.blogspot.com/2015/01/user-agent-strings.html - https://perishablepress.com/blacklist/ua-2013.txt - https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents - https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q - https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large - https://twitter.com/crep1x/status/1635034100213112833 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2017-07-08 modified: 2024-04-14 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Chrome /53.0 - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) - HttpBrowser/1.0 - '*<|>*' - nsis_inetc (mozilla) - Wget/1.9+cvs-stable (Red Hat modified) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) - '*zeroup*' - Mozilla/5.0 (Windows NT 5.1 ; v.* - '* adlib/*' - '* tiny' - '* BGroom *' - '* changhuatong' - '* CholTBAgent' - Mozilla/5.0 WinInet - RookIE/1.0 - M - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0) - backdoorbot - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) - Opera/8.81 (Windows NT 6.0; U; en) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30729) - Opera - Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) - MSIE - '*(Charon; Inferno)' - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT) - Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1) - Mozilla/5.0 (Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64) - Mozilla/4.0