Sigma high test sigma

Execution Of Non-Existing File

Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.

View Source

Detection Logic

{
  "filter_main_image_absolute_path": {
    "Image
| contains": "\\"
  },
  "filter_optional_null": {
    "Image": null
  },
  "filter_optional_empty": {
    "Image": [
      "-",
      ""
    ]
  },
  "filter_optional_4688": [
    {
      "Image": [
        "MemCompression",
        "Registry",
        "System",
        "vmmem",
        "vmmemWSL"
      ]
    },
    {
      "CommandLine": [
        "MemCompression",
        "Registry",
        "vmmem",
        "vmmemWSL"
      ]
    }
  ],
  "condition": "not 1 of filter_main_* and not 1 of filter_optional_*"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...