Uncommon FileSystem Load Attempt By Format.com

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Uncommon FileSystem Load Attempt By Format.com
id: 9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60
status: test
description: |
    Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.
references:
    - https://twitter.com/0gtweet/status/1477925112561209344
    - https://twitter.com/wdormann/status/1478011052130459653?s=20
author: Florian Roth (Nextron Systems)
date: 2022-01-04
modified: 2024-05-13
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\format.com'
        CommandLine|contains: '/fs:'
    filter_main_known_fs:
        CommandLine|contains:
            - '/fs:exFAT'
            - '/fs:FAT'
            - '/fs:NTFS'
            - '/fs:ReFS'
            - '/fs:UDF'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    Image|endswith: '\format.com'
    CommandLine|contains: '/fs:'

Stage 2: `not filter_main_known_fs`

filter_main_known_fs:
    CommandLine|contains:
        - '/fs:exFAT'
        - '/fs:FAT'
        - '/fs:NTFS'
        - '/fs:ReFS'
        - '/fs:UDF'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`/fs:FAT`	`excludes:CommandLine` `field:"CommandLine" value:"/fs:FAT"`
`CommandLine`	match	`/fs:NTFS`	`excludes:CommandLine` `field:"CommandLine" value:"/fs:NTFS"`
`CommandLine`	match	`/fs:ReFS`	`excludes:CommandLine` `field:"CommandLine" value:"/fs:ReFS"`
`CommandLine`	match	`/fs:UDF`	`excludes:CommandLine` `field:"CommandLine" value:"/fs:UDF"`
`CommandLine`	match	`/fs:exFAT`	`excludes:CommandLine` `field:"CommandLine" value:"/fs:exFAT"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/fs:`	`field:"CommandLine" kind:match value:"/fs:"`
`Image`	ends_with	`\format.com`	`field:"Image" kind:ends_with value:"\format.com"`