{"id":"805c55d9-31e6-4846-9878-c34c75054fe9","title":"Octopus Scanner Malware","description":"Detects Octopus Scanner Malware.","author":"NVISO","status":"test","level":"high","date":"2020-06-09","modified":"2021-11-27","tags":["attack.initial-access","attack.t1195","attack.t1195.001"],"technique_ids":["T1195","T1195.001"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain"],"source_path":"rules/windows/file/file_event/file_event_win_mal_octopus_scanner.yml","source_sha256":"f103ee389bebab256feadf9e5f293e64e37d616d1790879cfe4f9e3e8ccfb594","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_mal_octopus_scanner.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Octopus Scanner Malware\nid: 805c55d9-31e6-4846-9878-c34c75054fe9\nstatus: test\ndescription: Detects Octopus Scanner Malware.\nreferences:\n    - https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain\nauthor: NVISO\ndate: 2020-06-09\nmodified: 2021-11-27\ntags:\n    - attack.initial-access\n    - attack.t1195\n    - attack.t1195.001\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|endswith:\n            - '\\AppData\\Local\\Microsoft\\Cache134.dat'\n            - '\\AppData\\Local\\Microsoft\\ExplorerSync.db'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1195","id":"T1195","name":"Supply Chain Compromise","page":"techniques/enterprise/T1195/"},{"key":"enterprise/T1195.001","id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","page":"techniques/enterprise/T1195.001/"}],"data_path":"data/detection-rules/805c55d9-31e6-4846-9878-c34c75054fe9.json","kind":"sigma"}