Detectionmediumtest
Creation of a Diagcab
Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetFilename|endswith: '.diagcab'
condition: selectionFalse Positives
Legitimate microsoft diagcab
References
MITRE ATT&CK
Rule Metadata
Rule ID
3d0ed417-3d94-4963-a562-4a92c940656a
Status
test
Level
medium
Type
Detection
Created
Wed Jun 08
Author
Path
rules/windows/file/file_event/file_event_win_susp_diagcab.yml
Raw Tags
attack.resource-development