Detection rules › Sigma
NTFS hard link creation
Detects scenarios where an attacker attempts to create a hard link.
Known false positives
- admin activity on file server
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4664: An attempt was made to create a hard link. |
Rule body
title: NTFS hard link creation
description: Detects scenarios where an attacker attempts to create a hard link.
references:
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4664
tags:
- attack.persistence
- attack.t1547.009 # Boot or Logon Autostart Execution: Shortcut Modification
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
EventID: 4664
condition: selection
falsepositives:
- admin activity on file server
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4664