Windows PowerShell Script File Creation: SysAidServer Webapp User/User.exe Indicators
Detects creation of specific SysAidServer Tomcat webapp files indicative of PowerShell script staging on Windows.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-11-09
- Updated
- 2026-07-31
What it detects
Identifies Windows file events where a newly created file path matches specific SysAidServer Tomcat webapp locations used for user artifacts (including user.exe, usersfiles.war, and related user-related filenames/suffixes). Attackers may stage or drop scripts and payloads into web-accessible directories to execute later. The detection relies on telemetry from file creation events that include TargetFilename and supports matching by exact path suffixes and substring containment.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-script-file-creation-targeting-specific-sysaidserver-user-fil-e94486ea
title: "Windows PowerShell Script File Creation: SysAidServer Webapp User/User.exe Indicators"
id: d445cd7e-316a-487c-84d4-adc22c3d8ca2
status: test
description: Identifies Windows file events where a newly created file path matches specific SysAidServer Tomcat webapp locations used for user artifacts (including user.exe, usersfiles.war, and related user-related filenames/suffixes). Attackers may stage or drop scripts and payloads into web-accessible directories to execute later. The detection relies on telemetry from file creation events that include TargetFilename and supports matching by exact path suffixes and substring containment.
references:
- https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lace-Tempest/file_event_win_apt_lace_tempest_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-09
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
- TargetFilename|endswith:
- :\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe
- :\Program Files\SysAidServer\tomcat\webapps\usersfiles.war
- :\Program Files\SysAidServer\tomcat\webapps\leave
- TargetFilename|contains: :\Program Files\SysAidServer\tomcat\webapps\user.
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: e94486ea-2650-4548-bf25-88cbd0bb32d7
type: derived