detection.wiki

Detection rules › Sigma

Suspicious File Created In PerfLogs

Status
test
Severity
medium
Log source
category file_event, product windows
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects suspicious file based on their extension being created in "C:\PerfLogs". Note that this directory mostly contains ".etl" files

Known false positives

  • Unlikely

MITRE ATT&CK coverage

TacticTechniques
Execution

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 11: FileCreate

Rule body

title: Suspicious File Created In PerfLogs
id: bbb7e38c-0b41-4a11-b306-d2a457b7ac2b
status: test
description: Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
references:
    - Internal Research
    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-05
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\PerfLogs\'
        TargetFilename|endswith:
            - '.7z'
            - '.bat'
            - '.bin'
            - '.chm'
            - '.dll'
            - '.exe'
            - '.hta'
            - '.lnk'
            - '.ps1'
            - '.psm1'
            - '.py'
            - '.scr'
            - '.sys'
            - '.vbe'
            - '.vbs'
            - '.zip'
    condition: selection
falsepositives:
    - Unlikely
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetFilename|startswith: 'C:\PerfLogs\'
    TargetFilename|endswith:
        - '.7z'
        - '.bat'
        - '.bin'
        - '.chm'
        - '.dll'
        - '.exe'
        - '.hta'
        - '.lnk'
        - '.ps1'
        - '.psm1'
        - '.py'
        - '.scr'
        - '.sys'
        - '.vbe'
        - '.vbs'
        - '.zip'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetFilenameends_with
  • .7z corpus 5 (sigma 5)
  • .bat corpus 17 (sigma 17)
  • .bin
  • .chm corpus 4 (sigma 4)
  • .dll corpus 24 (sigma 24)
  • .exe corpus 21 (sigma 20, splunk 1)
  • .hta corpus 14 (sigma 14)
  • .lnk corpus 6 (sigma 6)
  • .ps1 corpus 17 (sigma 17)
  • .psm1 corpus 4 (sigma 4)
  • .py corpus 3 (sigma 3)
  • .scr corpus 8 (sigma 8)
  • .sys corpus 6 (sigma 6)
  • .vbe corpus 16 (sigma 16)
  • .vbs corpus 18 (sigma 18)
  • .zip corpus 7 (sigma 6, splunk 1)
field:"TargetFilename" kind:ends_with
TargetFilenamestarts_with
  • C:\PerfLogs\ corpus 2 (sigma 2)
field:"TargetFilename" kind:starts_with value:"C:\PerfLogs\"