security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Update defense_evasion_unusual_ads_file_creation.toml (#2522)

Browse Source
This commit is contained in:
Nic
2023-02-07 06:40:42 -06:00
committed by GitHub
parent 51b7df8613
commit 54b2f7582e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/defense_evasion_unusual_ads_file_creation.toml
+1 -1
View File
@@ -33,7 +33,7 @@ Attackers can abuse these alternate data streams to hide malicious files, string
#### Possible investigation steps #### Possible investigation steps
- Retrieve the contents of the alternate data stream, and analyze it for potential maliciousness. Analysts can use the following PowerShell cmdlet to accomplish this: - Retrieve the contents of the alternate data stream, and analyze it for potential maliciousness. Analysts can use the following PowerShell cmdlet to accomplish this:
- `Get-Content -file C:\\Path\\To\\file.exe -stream ADSname` - `Get-Content C:\\Path\\To\\file.exe -stream SampleAlternateDataStreamName`
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures. - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes. - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
- Investigate other alerts associated with the user/host during the past 48 hours. - Investigate other alerts associated with the user/host during the past 48 hours.