Detection rules › Sigma
Network Connection Initiated From Users\Public Folder
Detects a network connection initiated from a process located in the "C:\Users\Public" folder. Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone. Use this rule to hunt for potential suspicious or uncommon activity in your environement.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1105 Ingress Tool Transfer |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 3 | Network connection |
Rule body yaml
title: Network Connection Initiated From Users\Public Folder
id: bcb03938-9f8b-487d-8d86-e480691e1d71
related:
- id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
type: derived
status: test
description: |
Detects a network connection initiated from a process located in the "C:\Users\Public" folder.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
references:
- https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
author: Florian Roth (Nextron Systems)
date: 2024-05-31
tags:
- attack.command-and-control
- attack.t1105
- detection.threat-hunting
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
Image|contains: ':\Users\Public\'
filter_optional_ibm:
Image|contains: ':\Users\Public\IBM\ClientSolutions\Start_Programs\' # IBM Client Solutions Default Location (Added by Tim Shelton - https://github.com/SigmaHQ/sigma/pull/3053/files)
condition: selection and not 1 of filter_optional_*
falsepositives:
- Likely from legitimate third party application that execute from the "Public" directory.
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_optional_*Stage 1: selection
selection:
Initiated: 'true'
Image|contains: ':\Users\Public\'
Stage 2: not filter_optional_ibm
filter_optional_ibm:
Image|contains: ':\Users\Public\IBM\ClientSolutions\Start_Programs\'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Image | match | :\Users\Public\IBM\ClientSolutions\Start_Programs\ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.