Hayabusa medium test sigma

Potential Command Line Path Traversal Evasion Attempt

Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_1": {
    "Image
| contains": "\\Windows\\",
    "CommandLine
| contains": [
      "\\..\\Windows\\",
      "\\..\\System32\\",
      "\\..\\..\\"
    ]
  },
  "selection_2": {
    "CommandLine
| contains": ".exe\\..\\"
  },
  "filter_optional_google_drive": {
    "CommandLine
| contains": "\\Google\\Drive\\googledrivesync.exe\\..\\"
  },
  "filter_optional_citrix": {
    "CommandLine
| contains": "\\Citrix\\Virtual Smart Card\\Citrix.Authentication.VirtualSmartcard.Launcher.exe\\..\\"
  },
  "condition": "process_creation and (1 of selection_* and not 1 of filter_optional_*)"
}

False Positives

  • ⚠ Google Drive
  • ⚠ Citrix

Field Validations

Loading…

Comments (0)

Loading comments...