Windows: Small Sieve IoC File Creation via AppData and Typo Filename Indicators

Alerts on Windows file events with Small Sieve filename typo/path indicators or the OutlookDataPlus.txt IOCs.

FreeReviewedSigma · High · v5

Product: windows
Category: file_event
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-05-19
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.005Match Legitimate Resource Name or Location
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows file creation events where the target filename contains specific AppData path fragments indicative of the Small Sieve malware’s naming patterns, including a typo in “Microsift.” It also matches a known filename IoC ending with “\AppData\Local\MicrosoftWindowsOutlookDataPlus.txt.” These behaviors matter because malware often writes staged or configuration files into user AppData locations using characteristic filenames; the detection relies on Windows file event telemetry that includes the TargetFilename field.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)

Suspicious svchost.exe Execution From AppData Roaming Directory

Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)

Malicious WezRat Persistence via Chrome Updater Run Key

Malicious ValleyRAT RuntimeBroker Masquerade in RunTime Directory

Suspicious Execution of spools.exe from Public Directory

Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)

Windows: Small Sieve IoC File Creation via AppData and Typo Filename Indicators

Pivot detection · T1036.005 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-events-detect-small-sieve-typo-based-filename-indicators-and-outloo-39466c42

title: "Windows: Small Sieve IoC File Creation via AppData and Typo Filename Indicators"
id: e54bd9ec-b3ab-4254-b437-13c07c835b38
status: test
description: This rule identifies Windows file creation events where the target filename contains specific AppData path fragments indicative of the Small Sieve malware’s naming patterns, including a typo in “Microsift.” It also matches a known filename IoC ending with “\AppData\Local\MicrosoftWindowsOutlookDataPlus.txt.” These behaviors matter because malware often writes staged or configuration files into user AppData locations using characteristic filenames; the detection relies on Windows file event telemetry that includes the TargetFilename field.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Small-Sieve/file_event_win_malware_small_sieve_evasion_typo.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-19
tags:
  - attack.stealth
  - attack.t1036.005
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection_typo_path:
    TargetFilename|contains|all:
      - :\Users\
      - \AppData\
    TargetFilename|contains:
      - \Roaming\
      - \Local\
  selection_typo_keyword:
    TargetFilename|contains: Microsift
  selection_ioc:
    TargetFilename|endswith: \AppData\Local\MicrosoftWindowsOutlookDataPlus.txt
  condition: all of selection_typo_* or selection_ioc
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 39466c42-c189-476a-989f-8cdb135c163a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL