Windows File Creation of Octopus Scanner Malware Cache134.dat or ExplorerSync.db

title: Windows File Creation of Octopus Scanner Malware Cache134.dat or ExplorerSync.db
id: ff0e62c4-65e7-4e4a-9332-7ede4c671502
status: test
description: This rule flags file events where a target filename ends with either Cache134.dat or ExplorerSync.db under the Windows AppData cache or sync locations. These filenames are used by Octopus Scanner malware behavior, making them useful indicators for initial access and early staging. It relies on Windows file event telemetry that records file creation or modification paths and filenames.
references:
  - https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_mal_octopus_scanner.yml
author: NVISO, Huntrule Team
date: 2020-06-09
modified: 2021-11-27
tags:
  - attack.initial-access
  - attack.t1195
  - attack.t1195.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \AppData\Local\Microsoft\Cache134.dat
      - \AppData\Local\Microsoft\ExplorerSync.db
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 805c55d9-31e6-4846-9878-c34c75054fe9
    type: derived