Query: detect Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is requi in logs
Matching passage: Sigma rule: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is requi. Logsource: windows / raw_access_thread. Rule: title: Potential Defense Evasion Via Raw Disk Access By Uncommon Tools id: db809f10-56ce-4420-8c86-d6a7d793c79c status: test description: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2025-12-03 tags: - attack.stealth - attack.t1006 logsource: product: windows category: raw_access_thread detection: filter_main_floppy: Device|contains: floppy filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\CCM\ - C:\Windows\explorer.exe - C:\Windows\servicing\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemApps\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_main_system_images: Image: - Registry - System filter_main_windefender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: - \MsMpEng.exe - \MpDefenderCoreService.exe filter_main_microsoft_appdata: Image|startswith: C:\Users\ Image|contains|all: - \AppData\ - \Microsoft\ filter_main_ssd_nvme: Image|startswith: C:\Windows\Temp\ Image|endswith: - \Executables\SSDUpdate.exe - \HostMetadata\NVMEHostmetadata.exe filter_main_null: Image: null filter_main_systemsettings: Image: C:\Windows\ImmersiveControlPanel\SystemSettings.exe filter_main_update: Image|startswith: C:\$WinREAgent\Scratch\ filter_optional_github_desktop: Image|startswith: C:\Users\ Image|contains: \AppData\Local\GitHubDesktop\app- Image|endswith: \resources\app\git\mingw64\bin\git.exe filter_optional_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ Image|endswith: \thor.exe filter_optional_Keybase: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Keybase\upd.exe condition: not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Detects common NTLM brute force device names. Logsource: windows / ntlm. Rule: title: NTLM Brute Force id: 9c8acf1a-cbf9-4db6-b63c-74baabe03e59 status: test description: Detects common NTLM brute force device names references: - https://www.varonis.com/blog/investigate-ntlm-brute-force author: Jerry Shockley '@jsh0x' date: 2022-02-02 tags: - attack.credential-access - attack.t1110 logsource: product: windows service: ntlm definition: Requires events from Microsoft-Windows-NTLM/Operational detection: selection: EventID: 8004 devicename: WorkstationName: - Rdesktop - Remmina - Freerdp - Windows7 - Windows8 - Windows2012 - Windows2016 - Windows2019 condition: selection and devicename falsepositives: - Systems with names equal to the spoofed ones used by the brute force tools level: medium