Sigma medium test sigma

Potential Command Line Path Traversal Evasion Attempt

Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline

View Source

Detection Logic

{
  "selection_1": {
    "Image
| contains": "\\Windows\\",
    "CommandLine
| contains": [
      "\\..\\Windows\\",
      "\\..\\System32\\",
      "\\..\\..\\"
    ]
  },
  "selection_2": {
    "CommandLine
| contains": ".exe\\..\\"
  },
  "filter_optional_google_drive": {
    "CommandLine
| contains": "\\Google\\Drive\\googledrivesync.exe\\..\\"
  },
  "filter_optional_citrix": {
    "CommandLine
| contains": "\\Citrix\\Virtual Smart Card\\Citrix.Authentication.VirtualSmartcard.Launcher.exe\\..\\"
  },
  "condition": "1 of selection_* and not 1 of filter_optional_*"
}

False Positives

  • ⚠ Google Drive
  • ⚠ Citrix

Field Validations

Loading…

Comments (0)

Loading comments...