SigmaHQ/rules/windows/file_event/sysmon_tsclient_filewrite_startup.yml

title: Hijack Legit RDP Session to Move Laterally
id: 52753ea4-b3a0-4365-910d-36cff487b789
status: experimental
description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
date: 2019/02/21
author: Samir Bousseaden
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image: '*\mstsc.exe'
        TargetFilename: '*\Microsoft\Windows\Start Menu\Programs\Startup\\*'
    condition: selection
falsepositives:
    - unknown
level: high
Added rules files split into folders 2020-06-10 14:32:30 +00:00			`title: Hijack Legit RDP Session to Move Laterally`
			`id: 52753ea4-b3a0-4365-910d-36cff487b789`
			`status: experimental`
			`description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder`
			`date: 2019/02/21`
			`author: Samir Bousseaden`
			`logsource:`
			`product: windows`
Changed category names and remove sysmon log source 2020-06-24 15:41:21 +00:00			`category: file_event`
Added rules files split into folders 2020-06-10 14:32:30 +00:00			`detection:`
			`selection:`
			`Image: '*\mstsc.exe'`
Fixes for rules in the sysmon file_event category Fix a couple of typos For sysmon_hack_dumpert: Make sure the logsource is category file_event and not sysmon. Don't set the category at the global level. Instead set in the individual document. 2020-07-03 20:22:29 +00:00			`TargetFilename: '\Microsoft\Windows\Start Menu\Programs\Startup\\'`
Added rules files split into folders 2020-06-10 14:32:30 +00:00			`condition: selection`
			`falsepositives:`
			`- unknown`
			`level: high`