Hayabusa medium test sigma

Automated Collection Command Prompt

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_ext": {
    "CommandLine
| contains": [
      ".doc",
      ".docx",
      ".xls",
      ".xlsx",
      ".ppt",
      ".pptx",
      ".rtf",
      ".pdf",
      ".txt"
    ]
  },
  "selection_other_dir": {
    "CommandLine
| contains
| all": [
      "dir ",
      " /b ",
      " /s "
    ]
  },
  "selection_other_findstr": {
    "OriginalFileName": "FINDSTR.EXE",
    "CommandLine
| contains": [
      " /e ",
      " /si "
    ]
  },
  "condition": "process_creation and (selection_ext and 1 of selection_other_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...