Techniques
Sample rules
Use NTFS Short Name in Image
- source: sigma
- technicques:
- t1564
- t1564.004
Description
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection
Detection logic
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
filter_main_generic_parent:
ParentImage: C:\Windows\explorer.exe
filter_optional_thor:
ParentImage|endswith: \thor\thor64.exe
filter_optional_vcred:
Image|endswith: \VCREDI~1.EXE
filter_optional_webex:
ParentImage|endswith: \WebEx\WebexHost.exe
filter_optional_winzip:
Image: C:\PROGRA~1\WinZip\WZPREL~1.EXE
selection:
Image|contains:
- ~1.bat
- ~1.dll
- ~1.exe
- ~1.hta
- ~1.js
- ~1.msi
- ~1.ps1
- ~1.tmp
- ~1.vbe
- ~1.vbs
- ~2.bat
- ~2.dll
- ~2.exe
- ~2.hta
- ~2.js
- ~2.msi
- ~2.ps1
- ~2.tmp
- ~2.vbe
- ~2.vbs