SigmaHQ/rules/windows/file_event/sysmon_ghostpack_safetykatz.yml

title: Detection of SafetyKatz
id: e074832a-eada-4fd7-94a1-10642b130e16
status: experimental
description: Detects possible SafetyKatz Behaviour
references:
    - https://github.com/GhostPack/SafetyKatz
tags:
    - attack.credential_access
    - attack.t1003         # an old one
    - attack.t1003.001
author: Markus Neis
date: 2018/07/24
modified: 2020/08/23
logsource:
    category: file_event
    product: windows
detection:
    selection:        
        TargetFilename|endswith: '\Temp\debug.bin'
    condition: selection
falsepositives:
    - Unknown
level: high
Added rules files split into folders 2020-06-10 14:32:30 +00:00			`title: Detection of SafetyKatz`
			`id: e074832a-eada-4fd7-94a1-10642b130e16`
			`status: experimental`
			`description: Detects possible SafetyKatz Behaviour`
			`references:`
			`- https://github.com/GhostPack/SafetyKatz`
			`tags:`
			`- attack.credential_access`
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-24 23:09:17 +00:00			`- attack.t1003 # an old one`
			`- attack.t1003.001`
Added rules files split into folders 2020-06-10 14:32:30 +00:00			`author: Markus Neis`
			`date: 2018/07/24`
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-24 23:09:17 +00:00			`modified: 2020/08/23`
Added rules files split into folders 2020-06-10 14:32:30 +00:00			`logsource:`
Changed category names and remove sysmon log source 2020-06-24 15:41:21 +00:00			`category: file_event`
Added rules files split into folders 2020-06-10 14:32:30 +00:00			`product: windows`
			`detection:`
			`selection:`
Update sysmon_ghostpack_safetykatz.yml 2020-10-15 18:59:09 +00:00			`TargetFilename\|endswith: '\Temp\debug.bin'`
Added rules files split into folders 2020-06-10 14:32:30 +00:00			`condition: selection`
			`falsepositives:`
			`- Unknown`
			`level: high`