Detection rules › Splunk
Suspicious File Created in Public Folder (Sysmon)
Threat actors are increasingly utilizing the Public directory on Windows endpoints due to the ease of access and evasion. This use case detects file creation events for .dll, .exe, and .conf files in the Public directory. Note: if file writes to the \Users\Public directory are overly noisy, logic can be modified to the \Users\Public\Library directory.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1036.005 Masquerading: Match Legitimate Resource Name or Location |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 11 | FileCreate |
Rule body yaml
id: '27745.50435'
title: Suspicious File Created in Public Folder
description: 'Threat actors are increasingly utilizing the Public directory on Windows
endpoints due to the ease of access and evasion. This use case detects file creation
events for .dll, .exe, and .conf files in the Public directory. Note: if file writes
to the \Users\Public directory are overly noisy, logic can be modified to the \Users\Public\Library
directory.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=11) OR "<EventID>11<")
"\\Users\\Public\\" (".dll" OR ".dll0" OR ".conf" OR ".exe") | rex field=_raw "<Data
Name=''TargetFilename''>(?<target_filename>[^<]+)</Data>"| regex target_filename="(?i)\x5cUsers\x5cPublic\x5c.+\.(dll0?|conf|exe)"|
table _time, host, user, process_*, parent_process_name, parent_process_*, target_filename
| bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading
- defense-evasion:masquerading:match legitimate name or location
technique_id:
- T1036
- T1036.005
data_category:
- Windows Sysmon
references:
- https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
- https://blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities-for-detection
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=11) OR "<EventID>11<") "\\Users\\Public\\" (".dll" OR ".dll0" OR ".conf" OR ".exe")
Stage 2: rex
| rex field=_raw "<Data Name='TargetFilename'>(?<target_filename>[^<]+)</Data>"
Stage 3: regex
| regex target_filename="(?i)\x5cUsers\x5cPublic\x5c.+\.(dll0?|conf|exe)"
Stage 4: table
| table _time, host, user, process_*, parent_process_name, parent_process_*, target_filename
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
target_filename | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>11<" |
| 1 | "\\Users\\Public\\" |
| 1 | ".dll" |
| 1 | ".dll0" |
| 1 | ".conf" |
| 1 | ".exe" |