Detectionhightest
Loading Diagcab Package From Remote Path
Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Sun Aug 1450cb47b8-2c33-4b23-a2e9-4600657d9746windows
Log Source
Windowsdiagnosis-scripted
ProductWindows← raw: windows
Servicediagnosis-scripted← raw: diagnosis-scripted
Detection Logic
Detection Logic1 selector
detection:
selection:
EventID: 101
PackagePath|contains: '\\\\' # Example would be: \\webdav-test.herokuapp.com@ssl\DavWWWRoot\package
condition: selectionFalse Positives
Legitimate package hosted on a known and authorized remote location
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
50cb47b8-2c33-4b23-a2e9-4600657d9746
Status
test
Level
high
Type
Detection
Created
Sun Aug 14
Path
rules/windows/builtin/diagnosis/scripted/win_diagnosis_scripted_load_remote_diagcab.yml
Raw Tags
attack.execution