valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #2100 from kidrek/sysmon_delete_prefetch

Browse Source 
Add new rule - sysmon_delete_prefetch - AntiForensic
This commit is contained in:
frack113 2021-09-29 17:53:33 +02:00 committed by GitHub
commit 84ec2f582a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
rules/windows/file_delete/sysmon_delete_prefetch.yml Executable file
View File

@ -0,0 +1,23 @@
title: Prefetch File Deletion
id: 0a1f9d29-6465-4776-b091-7f43b26e4c89
status: experimental
description: Detects the deletion of a prefetch file (AntiForensic)
level: high
author: Cedric MAURUGEON
date: 2021/09/29
tags:
- attack.defense_evasion
- attack.t1070.004
logsource:
product: windows
category: file_delete
detection:
selection:
TargetFilename|startswith: 'C:\Windows\Prefetch\'
TargetFilename|endswith: '.pf'
exception:
Image: 'C:\windows\system32\svchost.exe'
User: 'NT AUTHORITY\SYSTEM'
condition: selection and not exception
falsepositives:
- Unknown