{"id":"5f87308a-0a5b-4623-ae15-d8fa1809bc60","title":"Suspicious Files in Default GPO Folder","description":"Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder","author":"elhoim","status":"test","level":"medium","date":"2022-04-28","modified":"","tags":["attack.stealth","attack.t1036.005"],"technique_ids":["T1036.005"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://redcanary.com/blog/intelligence-insights-november-2021/"],"source_path":"rules/windows/file/file_event/file_event_win_susp_default_gpo_dir_write.yml","source_sha256":"e11fdb57fdf217688224836e2e2efc48734152ee919803d8af97f7c86ae288f2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_default_gpo_dir_write.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Files in Default GPO Folder\nid: 5f87308a-0a5b-4623-ae15-d8fa1809bc60\nstatus: test\ndescription: Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder\nreferences:\n    - https://redcanary.com/blog/intelligence-insights-november-2021/\nauthor: elhoim\ndate: 2022-04-28\ntags:\n    - attack.stealth\n    - attack.t1036.005\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|contains: '\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\'\n        TargetFilename|endswith:\n            - '.dll'\n            - '.exe'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","page":"techniques/enterprise/T1036.005/"}],"data_path":"data/detection-rules/5f87308a-0a5b-4623-ae15-d8fa1809bc60.json","kind":"sigma"}