{"id":"91c945bc-2ad1-4799-a591-4d00198a1215","title":"Suspicious Access to Sensitive File Extensions","description":"Detects known sensitive file extensions accessed on a network share","author":"Samir Bousseaden","status":"test","level":"medium","date":"2019-04-03","modified":"2025-10-17","tags":["attack.collection","attack.t1039"],"technique_ids":["T1039"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Help Desk operator doing backup or re-imaging end user machine or backup software","Users working with these data types or exchanging message files"],"references":["Internal Research"],"source_path":"rules/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml","source_sha256":"a1276123a079fe5816edfa54c7cfda5183bb9058534a5b6fb9fa1c4673ec375c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Access to Sensitive File Extensions\nid: 91c945bc-2ad1-4799-a591-4d00198a1215\nrelated:\n    - id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc\n      type: similar\nstatus: test\ndescription: Detects known sensitive file extensions accessed on a network share\nreferences:\n    - Internal Research\nauthor: Samir Bousseaden\ndate: 2019-04-03\nmodified: 2025-10-17\ntags:\n    - attack.collection\n    - attack.t1039\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 5145\n        RelativeTargetName|endswith:\n            - '.bak'\n            - '.dmp'\n            - '.edb'\n            - '.kirbi'\n            - '.msg'\n            - '.nsf'\n            - '.nst'\n            - '.oab'\n            - '.ost'\n            - '.pst'\n            - '.rdp'\n            # - '\\groups.xml'  # Commented out: groups.xml is accessed legitimately by Group Policy processing; high FP rate in enterprise environments\n    condition: selection\nfalsepositives:\n    - Help Desk operator doing backup or re-imaging end user machine or backup software\n    - Users working with these data types or exchanging message files\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1039","id":"T1039","name":"Data from Network Shared Drive","page":"techniques/enterprise/T1039/"}],"data_path":"data/detection-rules/91c945bc-2ad1-4799-a591-4d00198a1215.json","kind":"sigma"}