Anvilogic high experimental spl

Network Connection with Suspicious Folder [splunk-sysmon]

Detects potential downloads to suspicious file locations like temp, appdata, and downloads. - Threat Actor Association: Alloy Taurus/Gallium, Lazarus, NewsPenguin, OilRig, TA413 - Software Association: LOWZERO, Vidar Stealer

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=3 
OR "Event>ID<3") ("Temporary Internet Files" 
OR TERM("TEMP") 
OR TERM("Downloads") 
OR TERM("Appdata"))
| regex process="(?i)Temp
| Downloads
| Appdata"
| table _time, host, user dest, direction, event_id, eventtype, parent_*, process, process_*, user, user_id, src_*, dest_*
| bin span=1s
| stats values(*) as * by _time, host, process

Field Validations

Loading…

Comments (0)

Loading comments...