Windows File Events: Detect Small Sieve typo-based filename indicators and OutlookDataPlus.txt IOС

title: "Windows File Events: Detect Small Sieve typo-based filename indicators and OutlookDataPlus.txt IOС"
id: e54bd9ec-b3ab-4254-b437-13c07c835b38
status: test
description: This rule flags Windows file creation or related file events where the target filename contains a specific typo pattern and AppData/roaming/local path fragments associated with Small Sieve indicators. It also matches a specific file name ending with \AppData\Local\MicrosoftWindowsOutlookDataPlus.txt, which the rule treats as an indicator of compromise. The detection relies on filename telemetry in Windows file_event events, using substring and suffix matches on the TargetFilename field.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Small-Sieve/file_event_win_malware_small_sieve_evasion_typo.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-19
tags:
  - attack.stealth
  - attack.t1036.005
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection_typo_path:
    TargetFilename|contains|all:
      - :\Users\
      - \AppData\
    TargetFilename|contains:
      - \Roaming\
      - \Local\
  selection_typo_keyword:
    TargetFilename|contains: Microsift
  selection_ioc:
    TargetFilename|endswith: \AppData\Local\MicrosoftWindowsOutlookDataPlus.txt
  condition: all of selection_typo_* or selection_ioc
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 39466c42-c189-476a-989f-8cdb135c163a
    type: derived