{"id":"d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e","title":"Sysprep on AppData Folder","description":"Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2018-06-22","modified":"2021-11-27","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["False positives depend on scripts and administrative tools used in the monitored environment"],"references":["https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets","https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b"],"source_path":"rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml","source_sha256":"19ebe64867d1e0d5bd0fd78762062029216df439dbb08d15f18648e6678ff3db","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Sysprep on AppData Folder\nid: d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e\nstatus: test\ndescription: Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)\nreferences:\n    - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets\n    - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-06-22\nmodified: 2021-11-27\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\sysprep.exe'\n        CommandLine|contains: '\\AppData\\'\n    condition: selection\nfalsepositives:\n    - False positives depend on scripts and administrative tools used in the monitored environment\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e.json","kind":"sigma"}