{"id":"8468111a-ef07-4654-903b-b863a80bbc95","title":"VHD Image Download Via Browser","description":"Detects creation of \".vhd\"/\".vhdx\" files by browser processes.\nMalware can use mountable Virtual Hard Disk \".vhd\" files to encapsulate payloads and evade security controls.\n","author":"frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'","status":"test","level":"medium","date":"2021-10-25","modified":"2023-05-05","tags":["attack.resource-development","attack.t1587.001"],"technique_ids":["T1587.001"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Legitimate downloads of \".vhd\" files would also trigger this"],"references":["https://redcanary.com/blog/intelligence-insights-october-2021/","https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/","https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"],"source_path":"rules/windows/file/file_event/file_event_win_vhd_download_via_browsers.yml","source_sha256":"f5dc8618cfa67f285d44e9f02b1de45fd65d8769264d0c8471859e085d14c68c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_vhd_download_via_browsers.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: VHD Image Download Via Browser\nid: 8468111a-ef07-4654-903b-b863a80bbc95\nstatus: test\ndescription: |\n    Detects creation of \".vhd\"/\".vhdx\" files by browser processes.\n    Malware can use mountable Virtual Hard Disk \".vhd\" files to encapsulate payloads and evade security controls.\nreferences:\n    - https://redcanary.com/blog/intelligence-insights-october-2021/\n    - https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/\n    - https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/\nauthor: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'\ndate: 2021-10-25\nmodified: 2023-05-05\ntags:\n    - attack.resource-development\n    - attack.t1587.001\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\brave.exe'\n            - '\\chrome.exe'\n            - '\\firefox.exe'\n            - '\\iexplore.exe'\n            - '\\maxthon.exe'\n            - '\\MicrosoftEdge.exe'\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n            - '\\opera.exe'\n            - '\\safari.exe'\n            - '\\seamonkey.exe'\n            - '\\vivaldi.exe'\n            - '\\whale.exe'\n        # We don't use \"endswith\" to also match with ADS logs and \".vhdx\". Example: \"TargetFilename: C:\\Users\\xxx\\Downloads\\windows.vhd:Zone.Identifier\"\n        TargetFilename|contains: '.vhd'\n    condition: selection\nfalsepositives:\n    - Legitimate downloads of \".vhd\" files would also trigger this\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1587.001","id":"T1587.001","name":"Malware","page":"techniques/enterprise/T1587.001/"}],"data_path":"data/detection-rules/8468111a-ef07-4654-903b-b863a80bbc95.json","kind":"sigma"}