Access To Potentially Sensitive Sysvol Files By Unusual Applications (via file_access)

title: Access To Potentially Sensitive Sysvol Files By Unusual Applications (via file_access)
id: afc097b8-8790-5514-92b2-6d73e04d5455
status: stable
description: This rule detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.
references:
    - https://attack.mitre.org/techniques/T1552/006/
    - https://github.com/vletoux/pingcastle
author: Huntrule Team
date: 2026-03-19
tags:
    - attack.credential-access
    - attack.t1552.006
logsource:
    category: file_access
    product: windows
    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
    selection:
        FileName|startswith: '\\'
        FileName|contains|all:
            - '\sysvol\'
            - '\Policies\'
        FileName|endswith:
            - 'audit.csv'
            - 'Files.xml'
            - 'GptTmpl.inf'
            - 'groups.xml'
            - 'Registry.pol'
            - 'Registry.xml'
            - 'scheduledtasks.xml'
            - 'scripts.ini'
            - 'services.xml'
    filter_main_generic:
        Image|startswith:
            - 'C:\Program Files (x86)\'
            - 'C:\Program Files\'
            - 'C:\Windows\system32\'
            - 'C:\Windows\SysWOW64\'
    filter_main_explorer:
        Image: 'C:\Windows\explorer.exe'
    filter_hr:
        Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\
        Image|endswith: \MsMpEng.exe
    condition: (selection and not 1 of filter_main_*) and not filter_hr
falsepositives:
    - Unknown
level: medium