detection.wiki

Detection rules › Sigma

VHD Image Download Via Browser

Status
test
Severity
medium
Log source
product windows, category file_event
Author
frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
Source
github.com/SigmaHQ/sigma

Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.

MITRE ATT&CK coverage

TacticTechniques
Resource DevelopmentT1587.001 Develop Capabilities: Malware

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: VHD Image Download Via Browser
id: 8468111a-ef07-4654-903b-b863a80bbc95
status: test
description: |
    Detects creation of ".vhd"/".vhdx" files by browser processes.
    Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.
references:
    - https://redcanary.com/blog/intelligence-insights-october-2021/
    - https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/
    - https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
date: 2021-10-25
modified: 2023-05-05
tags:
    - attack.resource-development
    - attack.t1587.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith:
            - '\brave.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\maxthon.exe'
            - '\MicrosoftEdge.exe'
            - '\msedge.exe'
            - '\msedgewebview2.exe'
            - '\opera.exe'
            - '\safari.exe'
            - '\seamonkey.exe'
            - '\vivaldi.exe'
            - '\whale.exe'
        # We don't use "endswith" to also match with ADS logs and ".vhdx". Example: "TargetFilename: C:\Users\xxx\Downloads\windows.vhd:Zone.Identifier"
        TargetFilename|contains: '.vhd'
    condition: selection
falsepositives:
    - Legitimate downloads of ".vhd" files would also trigger this
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    Image|endswith:
        - '\brave.exe'
        - '\chrome.exe'
        - '\firefox.exe'
        - '\iexplore.exe'
        - '\maxthon.exe'
        - '\MicrosoftEdge.exe'
        - '\msedge.exe'
        - '\msedgewebview2.exe'
        - '\opera.exe'
        - '\safari.exe'
        - '\seamonkey.exe'
        - '\vivaldi.exe'
        - '\whale.exe'
    TargetFilename|contains: '.vhd'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \MicrosoftEdge.exe corpus 3 (sigma 3)
  • \brave.exe corpus 11 (sigma 11)
  • \chrome.exe corpus 13 (sigma 13)
  • \firefox.exe corpus 6 (sigma 6)
  • \iexplore.exe corpus 5 (sigma 5)
  • \maxthon.exe corpus 3 (sigma 3)
  • \msedge.exe corpus 14 (sigma 14)
  • \msedgewebview2.exe corpus 3 (sigma 3)
  • \opera.exe corpus 11 (sigma 11)
  • \safari.exe corpus 2 (sigma 2)
  • \seamonkey.exe corpus 3 (sigma 3)
  • \vivaldi.exe corpus 11 (sigma 11)
  • \whale.exe corpus 3 (sigma 3)
TargetFilenamematch
  • .vhd