Detectionmediumtest

Use NTFS Short Name in Image

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

François Hubaut, Nasreddine Bencherchali (Nextron Systems)Created Sat Aug 06Updated Thu Jul 203ef5605c-9eb9-47b0-9a71-b727e6aa5c3bwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|contains:
            - '~1.bat'
            - '~1.dll'
            - '~1.exe'
            - '~1.hta'
            - '~1.js'
            - '~1.msi'
            - '~1.ps1'
            - '~1.tmp'
            - '~1.vbe'
            - '~1.vbs'
            - '~2.bat'
            - '~2.dll'
            - '~2.exe'
            - '~2.hta'
            - '~2.js'
            - '~2.msi'
            - '~2.ps1'
            - '~2.tmp'
            - '~2.vbe'
            - '~2.vbs'
    filter_main_generic_parent:
        ParentImage: 'C:\Windows\explorer.exe'
    filter_optional_webex:
        ParentImage|endswith: '\WebEx\WebexHost.exe'
    filter_optional_thor:
        ParentImage|endswith: '\thor\thor64.exe'
    filter_optional_winzip:
        Image: 'C:\PROGRA~1\WinZip\WZPREL~1.EXE'
    filter_optional_vcred:
        Image|endswith: '\VCREDI~1.EXE'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*