Hayabusa high test sigma

ISO File Created Within Temp Folders

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

View Source

Detection Logic

{
  "file_event": {
    "EventID": 11,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_1": {
    "TargetFilename
| contains
| all": [
      "\\AppData\\Local\\Temp\\",
      ".zip\\"
    ],
    "TargetFilename
| endswith": ".iso"
  },
  "selection_2": {
    "TargetFilename
| contains": "\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\",
    "TargetFilename
| endswith": ".iso"
  },
  "condition": "file_event and (1 of selection*)"
}

False Positives

⚠ Potential FP by sysadmin opening a zip file containing a legitimate ISO file

Field Validations

Loading…

Comments (0)

Loading comments...