Windows Browser Processes Creating .vhd/.vhdx Files

Alerts when a Windows browser process creates files containing .vhd, indicating potential VHD/VHDX staging.

FreeUnreviewedSigmamediumv1

windows-browser-processes-creating-vhd-vhdx-files-8468111a

title: Windows Browser Processes Creating .vhd/.vhdx Files
id: 9b19859f-207d-499e-982b-630f8cf6e5d5
status: test
description: This rule flags file creation events where the target filename contains .vhd and the creating process is a web browser executable on Windows. Attackers may leverage mountable VHD/VHDX files to package payloads and bypass or reduce visibility of malicious content. The detection relies on Windows file event telemetry that includes the process image path and the file target name being written.
references:
  - https://redcanary.com/blog/intelligence-insights-october-2021/
  - https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/
  - https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_vhd_download_via_browsers.yml
author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Huntrule Team
date: 2021-10-25
modified: 2023-05-05
tags:
  - attack.resource-development
  - attack.t1587.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \brave.exe
      - \chrome.exe
      - \firefox.exe
      - \iexplore.exe
      - \maxthon.exe
      - \MicrosoftEdge.exe
      - \msedge.exe
      - \msedgewebview2.exe
      - \opera.exe
      - \safari.exe
      - \seamonkey.exe
      - \vivaldi.exe
      - \whale.exe
    TargetFilename|contains: .vhd
  condition: selection
falsepositives:
  - Legitimate downloads of ".vhd" files would also trigger this
level: medium
license: DRL-1.1
related:
  - id: 8468111a-ef07-4654-903b-b863a80bbc95
    type: derived

What it detects

This rule flags file creation events where the target filename contains .vhd and the creating process is a web browser executable on Windows. Attackers may leverage mountable VHD/VHDX files to package payloads and bypass or reduce visibility of malicious content. The detection relies on Windows file event telemetry that includes the process image path and the file target name being written.

Known false positives

Legitimate downloads of ".vhd" files would also trigger this

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.