Techniques
Sample rules
Windows CAB File on Disk
- source: splunk
- technicques:
Description
The following analytic detects .cab files being written to disk. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is ‘*.cab’ and the action is ‘write’. This activity can be significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. Analysts should review the file path and associated artifacts for further investigation.
Detection logic
| tstats `security_content_summariesonly`
count values(Filesystem.file_path) as file_path
min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Filesystem WHERE
Filesystem.action IN ("created", "modified")
Filesystem.file_name="*.cab"
NOT Filesystem.file_path IN (
"*\\AppData\\Local\\Microsoft\\*",
"*\\Windows Kits\\10\\ADK\\Installers\\*",
"C:\\Program Files (x86)\\*",
"C:\\Program Files\\*",
"C:\\ProgramData\\Microsoft\\*",
"C:\\ProgramData\\Package Cache\\*",
"C:\\Windows\\appcompat\\*",
"C:\\Windows\\Logs\\CBS\\*",
"C:\\Windows\\servicing\\*",
"C:\\Windows\\SoftwareDistribution\\*",
"C:\\Windows\\System32\\*",
"C:\\Windows\\SystemApps\\*",
"C:\\Windows\\SysWOW64\\*",
"C:\\Windows\\WinSxS\\*",
)
BY Filesystem.action Filesystem.dest Filesystem.file_access_time
Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
Filesystem.file_name Filesystem.file_path Filesystem.file_acl
Filesystem.file_size Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product
| `drop_dm_object_name("Filesystem")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_cab_file_on_disk_filter`