Hayabusa medium test sigma

Potential Data Exfiltration Via Audio File

Detects potential exfiltration attempt via audio file using PowerShell

View Source

Detection Logic

{
  "ps_script": {
    "EventID": 4104,
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "PowerShellCore/Operational"
    ]
  },
  "selection_main": {
    "ScriptBlockText
| contains
| all": [
      "[System.Math]::",
      "[IO.FileMode]::",
      "BinaryWriter"
    ]
  },
  "selection_header_wav": {
    "ScriptBlockText
| contains
| all": [
      "0x52",
      "0x49",
      "0x46",
      "0x57",
      "0x41",
      "0x56",
      "0x45",
      "0xAC"
    ]
  },
  "condition": "ps_script and (selection_main and 1 of selection_header_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...