Windows System: NTFS Event ID 55 Corrupted File Record Exploitation Activity

title: "Windows System: NTFS Event ID 55 Corrupted File Record Exploitation Activity"
id: 72f5aea6-f426-4c2f-a172-21923fe12396
status: test
description: This rule flags Windows System Event ID 55 from the NTFS file system driver where the event description indicates a corrupted file record and includes a specific file name string. Such NTFS-related corruption may be exploited to impact file integrity and stability on affected hosts. Detection relies on Windows System logs capturing Provider_Name=Ntfs, Origin=File System Driver, and the event description text content.
references:
  - https://twitter.com/jonasLyk/status/1347900440000811010
  - https://twitter.com/wdormann/status/1347958161609809921
  - https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-11
modified: 2022-12-25
tags:
  - attack.impact
  - attack.t1499.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Ntfs
    EventID: 55
    Origin: File System Driver
    Description|contains|all:
      - contains a corrupted file record
      - The name of the file is "\"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: f14719ce-d3ab-4e25-9ce6-2899092260b0
    type: derived