title: Suspicious Unattend.xml File Access
id: 1a3d42dd-3763-46b9-8025-b5f17f340dfb
status: experimental
description: |
  Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
  If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process
author: frack113
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.001/T1552.001.md
date: 2021/12/19
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: '\unattend.xml'
  condition: selection
falsepositives:
  - Unknown
level: medium
tags:
  - attack.credential_access
  - attack.t1552.001
