Windows File Creation Indicators for ProgramData Payloads

title: Windows File Creation Indicators for ProgramData Payloads
id: a02db307-e50e-4974-a840-2a13ecea4800
status: test
description: This rule identifies Windows file creation events where the target filename ends with specific paths and executable/library/document names under \ProgramData. Attackers commonly stage payloads and supporting components in these locations before execution, making file creation telemetry a useful early signal. The detection relies on Windows file event data capturing the target filename ending with the listed indicators.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/file_event_win_apt_diamond_sleet_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - :\ProgramData\4800-84DC-063A6A41C5C
      - :\ProgramData\clip.exe
      - :\ProgramData\DSROLE.dll
      - :\ProgramData\Forest64.exe
      - :\ProgramData\readme.md
      - :\ProgramData\Version.dll
      - :\ProgramData\wsmprovhost.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e1212b32-55ff-4dfb-a595-62b572248056
    type: derived