Hayabusa high test sigma

Service Installation with Suspicious Folder Pattern

Detects service installation with suspicious folder patterns

View Source

Detection Logic

{
  "system": {
    "Channel": "System"
  },
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_img_paths": [
    {
      "ImagePath
| re": "^[Cc]:\\\\[Pp]rogram[Dd]ata\\\\.{1,9}\\.exe"
    },
    {
      "ImagePath
| re": "^[Cc]:\\\\.{1,9}\\.exe"
    }
  ],
  "condition": "system and (all of selection_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...