{"id":"654fcc6d-840d-4844-9b07-2c3300e54a26","title":"Legitimate Application Dropped Archive","description":"Detects programs on a Windows system that should not write an archive to disk","author":"frack113, Florian Roth","status":"test","level":"high","date":"2022-08-21","modified":"","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326"],"source_path":"rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml","source_sha256":"5472da99e9779b875019b0e034da3756db873293f3bce92033bdfccc9e87ce04","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Legitimate Application Dropped Archive\nid: 654fcc6d-840d-4844-9b07-2c3300e54a26\nstatus: test\ndescription: Detects programs on a Windows system that should not write an archive to disk\nreferences:\n    - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326\nauthor: frack113, Florian Roth\ndate: 2022-08-21\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        Image|endswith:\n            # Microsoft Office Programs Dropping Executables\n            - \\winword.exe\n            - \\excel.exe\n            - \\powerpnt.exe\n            - \\msaccess.exe\n            - \\mspub.exe\n            - \\eqnedt32.exe\n            - \\visio.exe\n            - \\wordpad.exe\n            - \\wordview.exe\n            # LOLBINs that can be used to download executables\n            - \\certutil.exe\n            - \\certoc.exe\n            - \\CertReq.exe\n            # - \\bitsadmin.exe (depends on the environment; comment in if you're sure that bitsadmin doesn't do that in your env)\n            - \\Desktopimgdownldr.exe\n            - \\esentutl.exe\n            # - \\expand.exe\n            - \\finger.exe\n            # Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)\n            - \\notepad.exe\n            - \\AcroRd32.exe\n            - \\RdrCEF.exe\n            - \\mshta.exe\n            - \\hh.exe\n        TargetFilename|endswith:\n            - '.zip'\n            - '.rar'\n            - '.7z'\n            - '.diagcab'\n            - '.appx'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/654fcc6d-840d-4844-9b07-2c3300e54a26.json","kind":"sigma"}