Suspicious Unblock-File

calendar Jan 27, 2023 · attack.defense_evasion attack.t1553.005  ·
Share on: linkedin copy

Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.

Sigma rule (View on GitHub)

 1title: Suspicious Unblock-File
 2id: 5947497f-1aa4-41dd-9693-c9848d58727d
 3status: test
 4description: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-3---remove-the-zoneidentifier-alternate-data-stream
 7    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2
 8author: frack113
 9date: 2022/02/01
10tags:
11    - attack.defense_evasion
12    - attack.t1553.005
13logsource:
14    product: windows
15    category: ps_script
16    definition: 'Requirements: Script Block Logging must be enabled'
17detection:
18    selection:
19        ScriptBlockText|contains|all:
20            - 'Unblock-File '
21            - '-Path '
22    condition: selection
23falsepositives:
24    - Legitimate PowerShell scripts
25level: medium

References

  • atomic-red-team/atomics/T1553.005/T1553.005.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

    Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team


    Read More

  • Unblock-File (Microsoft.PowerShell.Utility) - PowerShell

    This cmdlet only works on the Windows and macOS platforms. The Unblock-File cmdlet lets you open files that were downloaded from the internet. It unblocks PowerShell script files that were downloaded from the internet so you can run them, even when the PowerShell execution policy is RemoteSigned. By default, these files are blocked to protect the computer from untrusted files. Before using the Unblock-File cmdlet, review the file and its source and verify that it is safe to open. Internally, the Unblock-File cmdlet removes the Zone.Identifier alternate data stream, which has a value of 3 to indicate that it was downloaded from the internet. For more information about PowerShell execution policies, see about_Execution_Policies. This cmdlet was introduced in Windows PowerShell 3.0.


    Read More

Related rules

to-top