Detection rules › Sigma
ADS Zone.Identifier Deleted By Uncommon Application
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1070.004 Indicator Removal: File Deletion |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 23 | FileDelete (File Delete archived) |
| Sysmon | 26 | FileDeleteDetected (File Delete logged) |
Stages and Predicates
Stage 1: selection
TargetFilename|endswith: ':Zone.Identifier'
Stage 2: not 1 of filter_main_generic
Image: ['C:\Program Files\PowerShell\7-preview\pwsh.exe', 'C:\Program Files\PowerShell\7\pwsh.exe', 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe', 'C:\Windows\SysWOW64\explorer.exe', 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe', 'C:\Windows\explorer.exe']
Stage 3: not 1 of filter_optional_*
Image: ['C:\Program Files (x86)\Google\Chrome\Application\chrome.exe', 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe', 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe', 'C:\Program Files\Google\Chrome\Application\chrome.exe', 'C:\Program Files\Microsoft\Edge\Application\msedge.exe', 'C:\Program Files\Mozilla Firefox\firefox.exe']
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | eq |
|
TargetFilename | ends_with |
|