huntrule

Windows File Access to Unattend.XML in Panther Directory

Alerts on attempts to access Panther\unattend.xml on Windows, a potential source of embedded credentials.

FreeUnreviewedSigmalowv1
title: Windows File Access to Unattend.XML in Panther Directory
id: b58186a0-620d-404f-a5ab-32f6ae9b598c
status: test
description: This rule flags Windows file access events targeting \Panther\unattend.xml, which can be present during automated unattended installation. Attackers may look for this file because it can contain sensitive configuration details, including credentials. Detection relies on Windows file access telemetry that provides the accessed file path and filename.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_access/file_access_win_susp_unattend_xml.yml
author: frack113, Huntrule Team
date: 2024-07-22
tags:
  - attack.credential-access
  - attack.t1552.001
  - detection.threat-hunting
logsource:
  product: windows
  category: file_access
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    FileName|endswith: \Panther\unattend.xml
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 76a26006-0942-430b-8249-bd51d448f8e5
    type: derived

What it detects

This rule flags Windows file access events targeting \Panther\unattend.xml, which can be present during automated unattended installation. Attackers may look for this file because it can contain sensitive configuration details, including credentials. Detection relies on Windows file access telemetry that provides the accessed file path and filename.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.