Hayabusa high test sigma

Formbook Process Creation

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection1": {
    "ParentCommandLine
| startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ],
    "ParentCommandLine
| endswith": ".exe"
  },
  "selection2": [
    {
      "CommandLine
| contains
| all": [
        "/c",
        "del",
        "C:\\Users\\",
        "\\AppData\\Local\\Temp\\"
      ]
    },
    {
      "CommandLine
| contains
| all": [
        "/c",
        "del",
        "C:\\Users\\",
        "\\Desktop\\"
      ]
    },
    {
      "CommandLine
| contains
| all": [
        "/C",
        "type nul >",
        "C:\\Users\\",
        "\\Desktop\\"
      ]
    }
  ],
  "selection3": {
    "CommandLine
| endswith": ".exe"
  },
  "condition": "process_creation and (all of selection*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...