Windows File Creation: inetmgr.exe in \Windows\ADFS\bg\ Path
Alerts on creation of \Windows\ADFS\bg\inetmgr.exe in Windows file events.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-24
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where the target filename ends with :\Windows\ADFS\bg\inetmgr.exe on Windows. Attackers may place or stage executables in unusual system-adjacent directories to support execution or persistence, making this a high-signal anomaly. The detection relies on Windows file event telemetry that includes the full target filename/path for newly created files.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Onyx-Sleet/file_event_win_apt_onyx_sleet_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-creation-of-adfs-inetmgr-exe-path-used-by-onyx-sleet-2fef4fd9
title: |-
Windows File Creation: inetmgr.exe in
\Windows\ADFS\bg\ Path
id: 137f716f-c63d-4124-b2d9-da8906b7cb7d
status: test
description: This rule flags file creation events where the target filename ends with :\Windows\ADFS\bg\inetmgr.exe on Windows. Attackers may place or stage executables in unusual system-adjacent directories to support execution or persistence, making this a high-signal anomaly. The detection relies on Windows file event telemetry that includes the full target filename/path for newly created files.
references:
- https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Onyx-Sleet/file_event_win_apt_onyx_sleet_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: :\Windows\ADFS\bg\inetmgr.exe
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 2fef4fd9-7206-40d1-b4f5-ad6441d0cd9b
type: derived