mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 09:48:58 +00:00
40 lines
1.0 KiB
YAML
40 lines
1.0 KiB
YAML
title: Suspicious Access to Sensitive File Extensions
|
|
id: 91c945bc-2ad1-4799-a591-4d00198a1215
|
|
description: Detects known sensitive file extensions accessed on a network share
|
|
author: Samir Bousseaden
|
|
date: 2019/04/03
|
|
modified: 2020/08/23
|
|
tags:
|
|
- attack.collection
|
|
- attack.t1039
|
|
logsource:
|
|
product: windows
|
|
service: security
|
|
detection:
|
|
selection:
|
|
EventID:
|
|
- 5145
|
|
RelativeTargetName|endswith:
|
|
- '.pst'
|
|
- '.ost'
|
|
- '.msg'
|
|
- '.nst'
|
|
- '.oab'
|
|
- '.edb'
|
|
- '.nsf'
|
|
- '.bak'
|
|
- '.dmp'
|
|
- '.kirbi'
|
|
- '\groups.xml'
|
|
- '.rdp'
|
|
condition: selection
|
|
fields:
|
|
- ComputerName
|
|
- SubjectDomainName
|
|
- SubjectUserName
|
|
- RelativeTargetName
|
|
falsepositives:
|
|
- Help Desk operator doing backup or re-imaging end user machine or pentest or backup software
|
|
- Users working with these data types or exchanging message files
|
|
level: medium
|