detection.wiki

Detection rules › Sigma

NTFS hard link creation

Status
experimental
Severity
medium
Log source
product windows, category process_creation
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to create a hard link.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1547.009 Boot or Logon Autostart Execution: Shortcut Modification

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4664An attempt was made to create a hard link.

Rule body yaml

title: NTFS hard link creation
description: Detects scenarios where an attacker attempts to create a hard link.
references:
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4664
tags:
- attack.persistence
- attack.t1547.009 # Boot or Logon Autostart Execution: Shortcut Modification 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    EventID: 4664
  condition: selection
falsepositives:
- admin activity on file server
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4664