Stored Credentials in Fake Files

calendar Apr 21, 2023 · attack.credential_access attack.t1555  ·
Share on: linkedin copy

Search for accessing of fake files with stored credentials

Sigma rule (View on GitHub)

 1title: Stored Credentials in Fake Files
 2id: 692b979c-f747-41dc-ad72-1f11c01b110e
 3description: Search for accessing of fake files with stored credentials
 4status: unsupported
 5author: Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community
 6date: 2020/10/05
 7references: 
 8    - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-13-638.jpg
 9tags:
10    - attack.credential_access
11    - attack.t1555
12logsource:
13    product: windows
14    service: security
15detection:
16    selection:
17        EventID: 4663
18        AccessList|contains: '%%4416'
19        ObjectName|endswith:
20            - '\%POLICY_ID%\Machine\Preferences\Groups\Groups.xml'
21            - '\%FOLDER_NAME%\Unattend.xml'
22    condition: selection
23fields:
24    - EventID
25    - AccessList
26    - ObjectName
27falsepositives:
28    - Unknown
29level: high```

References

  • ÿØÿàJFIFÿâICC_PROFILE lcmsmntrRGB XYZ Ü)9acspAPPLöÖÓ-lcms descü^cprt\ wtpthbkpt|rXYZ�gXYZ¤bXYZ¸rTRCÌ@gTRCÌ@bTRCÌ@descc2textFBXYZ öÖÓ-XYZ 3¤XYZ o¢8õ�XYZ b™·…ÚX...


    Read More

Related rules

to-top