huntrule

Windows PowerShell script file creation targeting specific SysAidServer user file paths

Detects creation of specific SysAidServer Tomcat webapp files indicative of PowerShell script staging on Windows.

FreeUnreviewedSigmahighv1
title: Windows PowerShell script file creation targeting specific SysAidServer user file paths
id: d445cd7e-316a-487c-84d4-adc22c3d8ca2
status: test
description: This rule flags Windows file events where a newly created file matches specific SysAidServer Tomcat webapp paths and names, including entries ending in user.exe, usersfiles.war, and leave, or containing the substring user. Adversaries may use these filenames and locations to stage or deploy payloads through a webapp directory that blends into legitimate application structure. The detection relies on file event telemetry that includes the target filename for created files.
references:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lace-Tempest/file_event_win_apt_lace_tempest_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-09
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    - TargetFilename|endswith:
        - :\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe
        - :\Program Files\SysAidServer\tomcat\webapps\usersfiles.war
        - :\Program Files\SysAidServer\tomcat\webapps\leave
    - TargetFilename|contains: :\Program Files\SysAidServer\tomcat\webapps\user.
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e94486ea-2650-4548-bf25-88cbd0bb32d7
    type: derived

What it detects

This rule flags Windows file events where a newly created file matches specific SysAidServer Tomcat webapp paths and names, including entries ending in user.exe, usersfiles.war, and leave, or containing the substring user. Adversaries may use these filenames and locations to stage or deploy payloads through a webapp directory that blends into legitimate application structure. The detection relies on file event telemetry that includes the target filename for created files.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.