Detection rules › Sigma

ADS Zone.Identifier Deleted By Uncommon Application

Severity
medium
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1070.004 Indicator Removal: File Deletion

Event coverage

ProviderEvent IDTitle
Sysmon23FileDelete (File Delete archived)
Sysmon26FileDeleteDetected (File Delete logged)

Stages and Predicates

Stage 1: selection

TargetFilename|endswith: ':Zone.Identifier'

Stage 2: not 1 of filter_main_generic

Image: ['C:\Program Files\PowerShell\7-preview\pwsh.exe', 'C:\Program Files\PowerShell\7\pwsh.exe', 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe', 'C:\Windows\SysWOW64\explorer.exe', 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe', 'C:\Windows\explorer.exe']

Stage 3: not 1 of filter_optional_*

Image: ['C:\Program Files (x86)\Google\Chrome\Application\chrome.exe', 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe', 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe', 'C:\Program Files\Google\Chrome\Application\chrome.exe', 'C:\Program Files\Microsoft\Edge\Application\msedge.exe', 'C:\Program Files\Mozilla Firefox\firefox.exe']

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageeq
  • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe corpus 11 (sigma 11)
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe corpus 11 (sigma 11)
  • C:\Program Files (x86)\Mozilla Firefox\firefox.exe corpus 11 (sigma 11)
  • C:\Program Files\Google\Chrome\Application\chrome.exe corpus 12 (sigma 12)
  • C:\Program Files\Microsoft\Edge\Application\msedge.exe corpus 11 (sigma 11)
  • C:\Program Files\Mozilla Firefox\firefox.exe corpus 12 (sigma 12)
  • C:\Program Files\PowerShell\7-preview\pwsh.exe corpus 3 (sigma 3)
  • C:\Program Files\PowerShell\7\pwsh.exe corpus 4 (sigma 4)
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe corpus 3 (sigma 3)
  • C:\Windows\SysWOW64\explorer.exe corpus 2 (sigma 2)
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe corpus 4 (sigma 4)
  • C:\Windows\explorer.exe corpus 9 (sigma 9)
TargetFilenameends_with
  • :Zone.Identifier corpus 3 (sigma 3)