huntrule

Windows VBS gatherNetworkInfo Output Files Written to System32\config

Flags Windows file writes under System32\config consistent with gatherNetworkInfo.vbs network reconnaissance output.

FreeUnreviewedSigmamediumv1
title: Windows VBS gatherNetworkInfo Output Files Written to System32\config
id: 7747a65d-9d31-454d-8748-cd002468c457
related:
  - id: 575dce0c-8139-4e30-9295-1ee75969f7fe
    type: similar
  - id: 07aa184a-870d-413d-893a-157f317f6f58
    type: similar
  - id: f92a6f1e-a512-4a15-9735-da09e78d7273
    type: derived
status: test
description: This rule identifies file write events where outputs associated with the built-in reconnaissance script gatherNetworkInfo.vbs are created under C:\Windows\System32\config. Attackers may use this kind of system discovery to enumerate network-related information prior to further actions. The detection relies on file event telemetry that records TargetFilename with specific filename prefixes and suffixes in the config directory.
references:
  - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
  - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lolbin_gather_network_info_script_output.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
tags:
  - attack.discovery
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|startswith: C:\Windows\System32\config
    TargetFilename|endswith:
      - \Hotfixinfo.txt
      - \netiostate.txt
      - \sysportslog.txt
      - \VmSwitchLog.evtx
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule identifies file write events where outputs associated with the built-in reconnaissance script gatherNetworkInfo.vbs are created under C:\Windows\System32\config. Attackers may use this kind of system discovery to enumerate network-related information prior to further actions. The detection relies on file event telemetry that records TargetFilename with specific filename prefixes and suffixes in the config directory.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.