Techniques
Sample rules
Windows NirSoft Tool Bundle File Created
- source: splunk
- technicques:
Description
The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration. The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system. Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools.
Detection logic
| tstats `security_content_summariesonly`
count values(Filesystem.file_path) as file_path
min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Filesystem WHERE
Filesystem.file_name = "*.zip"
BY Filesystem.action Filesystem.dest Filesystem.file_create_time Filesystem.file_hash
Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product
| `drop_dm_object_name("Filesystem")`
``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ```
| search [
| inputlookup nirsoft_utilities_lookup
| search original_file_name = "*.zip"
| table original_file_name
| rename original_file_name as file_name
]
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_nirsoft_tool_bundle_file_created_filter`