Windows File Creation of ADFS inetmgr.exe Path Used by Onyx Sleet

Alerts on creation of \Windows\ADFS\bg\inetmgr.exe in Windows file events.

FreeUnreviewedSigmahighv1

windows-file-creation-of-adfs-inetmgr-exe-path-used-by-onyx-sleet-2fef4fd9

title: Windows File Creation of ADFS inetmgr.exe Path Used by Onyx Sleet
id: 137f716f-c63d-4124-b2d9-da8906b7cb7d
status: test
description: This rule flags Windows file creation events where the target filename ends with :\Windows\ADFS\bg\inetmgr.exe. Attackers may drop or stage binaries in unusual ADFS subdirectories to blend into expected application paths. It relies on Windows file event telemetry that includes the target filename for created files.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Onyx-Sleet/file_event_win_apt_onyx_sleet_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: :\Windows\ADFS\bg\inetmgr.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 2fef4fd9-7206-40d1-b4f5-ad6441d0cd9b
    type: derived

What it detects

This rule flags Windows file creation events where the target filename ends with :\Windows\ADFS\bg\inetmgr.exe. Attackers may drop or stage binaries in unusual ADFS subdirectories to blend into expected application paths. It relies on Windows file event telemetry that includes the target filename for created files.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.