Windows File Access Attempt to Panther\unattend.xml During Unattended Install

Alerts on attempts to access Panther\unattend.xml on Windows, a potential source of embedded credentials.

FreeReviewedSigma · Low · v5

Product: windows
Category: file_access
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2024-07-22
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Flags attempts to access files named Panther\unattend.xml on Windows, a location commonly associated with unattended installation configuration. Attackers may target this file because it can contain sensitive data such as credentials used during deployment. The detection relies on Windows file access telemetry that records the accessed filename, matching entries that end with \Panther\unattend.xml.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Malicious Veeam Backup Credential Theft via psql Query of Credentials Table (via process_creation)

Malicious Marimo Notebook Credential File Access via Shell (via process_creation)

Malicious Keyhunter Worker Persistence via Systemd Service

Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

Suspicious GitHub CLI Auth Token Extraction via Command Line

Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)

Windows File Access Attempt to Panther\unattend.xml During Unattended Install

Pivot detection · T1552.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-access-to-unattend-xml-in-panther-directory-76a26006

title: Windows File Access Attempt to Panther\unattend.xml During Unattended Install
id: b58186a0-620d-404f-a5ab-32f6ae9b598c
status: test
description: Flags attempts to access files named Panther\unattend.xml on Windows, a location commonly associated with unattended installation configuration. Attackers may target this file because it can contain sensitive data such as credentials used during deployment. The detection relies on Windows file access telemetry that records the accessed filename, matching entries that end with \Panther\unattend.xml.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_access/file_access_win_susp_unattend_xml.yml
author: frack113, Huntrule Team
date: 2024-07-22
tags:
  - attack.credential-access
  - attack.t1552.001
  - detection.threat-hunting
logsource:
  product: windows
  category: file_access
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    FileName|endswith: \Panther\unattend.xml
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 76a26006-0942-430b-8249-bd51d448f8e5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL