valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Create powershell_NTFS_Alternate_Data_Streams

Browse Source
This commit is contained in:
Lurkkeli 2018-07-24 19:49:08 +02:00 committed by GitHub
parent afe8bd6a57
commit ad580635ea
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
rules/windows/powershell/powershell_NTFS_Alternate_Data_Streams Normal file
View File

@ -0,0 +1,21 @@
title: NTFS Alternate Data Stream
status: experimental
description: Detects writing data into NTFS alternate data streams from powershell
references:
- http://www.powertheshell.com/ntfsstreams/
tags:
- attack.defense_Evasion
- attack.t1096
author: Sami Ruohone (rule)
logsource:
product: windows
service: powershell
description: 'It is recommanded to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277'
detection:
keywords:
- set-content
stream
condition: keywords
falsepositives:
- unknown
level: high