Alternate Data Stream Creation/Execution at Volume Root Directory

 1[metadata]
 2creation_date = "2024/03/14"
 3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies the creation of an Alternate Data Stream (ADS) at a volume root directory, which can indicate the attempt to
13hide tools and malware, as ADSs created in this directory are not displayed by system utilities.
14"""
15from = "now-9m"
16index = [
17    "winlogbeat-*",
18    "logs-endpoint.events.process-*",
19    "logs-endpoint.events.file-*",
20    "logs-windows.sysmon_operational-*",
21    "logs-m365_defender.event-*",
22    "logs-sentinel_one_cloud_funnel.*",
23    "endgame-*",
24]
25language = "eql"
26license = "Elastic License v2"
27name = "Alternate Data Stream Creation/Execution at Volume Root Directory"
28references = ["https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/"]
29risk_score = 47
30rule_id = "ff6cf8b9-b76c-4cc1-ac1b-4935164d1029"
31severity = "medium"
32tags = [
33    "Domain: Endpoint",
34    "OS: Windows",
35    "Use Case: Threat Detection",
36    "Tactic: Defense Evasion",
37    "Data Source: Elastic Defend",
38    "Data Source: Sysmon",
39    "Data Source: Microsoft Defender for Endpoint",
40    "Data Source: SentinelOne",
41    "Data Source: Elastic Endgame",
42]
43timestamp_override = "event.ingested"
44type = "eql"
45
46query = '''
47any where host.os.type == "windows" and event.category in ("file", "process") and 
48  (
49    (event.type == "creation" and file.path regex~ """[A-Z]:\\:.+""") or 
50    (event.type == "start" and process.executable regex~ """[A-Z]:\\:.+""")
51  )
52'''
53
54
55[[rule.threat]]
56framework = "MITRE ATT&CK"
57[[rule.threat.technique]]
58id = "T1564"
59name = "Hide Artifacts"
60reference = "https://attack.mitre.org/techniques/T1564/"
61[[rule.threat.technique.subtechnique]]
62id = "T1564.004"
63name = "NTFS File Attributes"
64reference = "https://attack.mitre.org/techniques/T1564/004/"
65
66
67
68[rule.threat.tactic]
69id = "TA0005"
70name = "Defense Evasion"
71reference = "https://attack.mitre.org/tactics/TA0005/"