Hayabusa medium test sigma

Windows Network Access Suspicious desktop.ini Action

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": 5145,
    "ObjectType": "File",
    "RelativeTargetName
| endswith": "\\desktop.ini",
    "AccessList
| contains": [
      "WriteData",
      "DELETE",
      "WriteDAC",
      "AppendData",
      "AddSubdirectory"
    ]
  },
  "condition": "security and selection"
}

False Positives

⚠ Read only access list authority

Field Validations

Loading…

Comments (0)

Loading comments...