Windows File Events: ProgramData Suspicious Driver/Script File Creation Pattern

title: "Windows File Events: ProgramData Suspicious Driver/Script File Creation Pattern"
id: 62062b5b-00fe-4f37-9a1a-ca4e00eda8c4
status: test
description: This rule flags Windows file creation events where TargetFilename appears under C:\ProgramData with specific naming patterns consistent with driver-related artifacts and accompanying batch scripts. It also matches ProgramData paths starting with vendor-like subfolders (e.g., Microsoft, Adobe, Intel, NVIDIA) and inf filenames containing prnms003.inf_ or prnms009.inf_, plus additional indicators like the string \wayzgoose paired with a .dll. The behavior matters because attackers may stage payloads or post-compromise tools in ProgramData to persist or execute later, and the detection relies on file event telemetry that records the created path and filename.
references:
  - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-23
modified: 2024-07-11
tags:
  - attack.defense-impairment
  - attack.t1685.001
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection_programdata_driver_store:
    TargetFilename|startswith:
      - C:\ProgramData\Microsoft\v
      - C:\ProgramData\Adobe\v
      - C:\ProgramData\Comms\v
      - C:\ProgramData\Intel\v
      - C:\ProgramData\Kaspersky Lab\v
      - C:\ProgramData\Bitdefender\v
      - C:\ProgramData\ESET\v
      - C:\ProgramData\NVIDIA\v
      - C:\ProgramData\UbiSoft\v
      - C:\ProgramData\Steam\v
    TargetFilename|contains:
      - \prnms003.inf_
      - \prnms009.inf_
  selection_programdata_main:
    TargetFilename|startswith: C:\ProgramData\
  selection_programdata_files_1:
    TargetFilename|endswith:
      - .save
      - \doit.bat
      - \execute.bat
      - \servtask.bat
  selection_programdata_files_2:
    TargetFilename|contains: \wayzgoose
    TargetFilename|endswith: .dll
  condition: selection_programdata_driver_store or (selection_programdata_main and 1 of selection_programdata_files_*)
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: b92d1d19-f5c9-4ed6-bbd5-7476709dc389
    type: derived