Detection rules › Sigma
Lace Tempest File Indicators
Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7
Known false positives
- Unlikely
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | No specific technique |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 11: FileCreate |
Rule body
title: Lace Tempest File Indicators
id: e94486ea-2650-4548-bf25-88cbd0bb32d7
status: test
description: Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7
references:
- https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-11-09
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
- TargetFilename|endswith:
- ':\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe'
- ':\Program Files\SysAidServer\tomcat\webapps\usersfiles.war'
- ':\Program Files\SysAidServer\tomcat\webapps\leave'
- TargetFilename|contains: ':\Program Files\SysAidServer\tomcat\webapps\user.'
condition: selection
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
- TargetFilename|endswith:
- ':\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe'
- ':\Program Files\SysAidServer\tomcat\webapps\usersfiles.war'
- ':\Program Files\SysAidServer\tomcat\webapps\leave'
- TargetFilename|contains: ':\Program Files\SysAidServer\tomcat\webapps\user.'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with |
TargetFilename | match |
| field:"TargetFilename" kind:match value:":\Program Files\SysAidServer\tomcat\webapps\user." |