Skip to content

Commit 52c53f9

Browse files
swachchhanda000swachchhanda000
authored
Merge branch 'master' into feb26_fpfixes
2 parents 7f9638b + 3fb14d9 commit 52c53f9

24 files changed

Lines changed: 1015 additions & 549 deletions

‎.github/latest_archiver_output.md‎

Lines changed: 558 additions & 534 deletions
Large diffs are not rendered by default.

‎deprecated/deprecated.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,3 +159,4 @@ e28a5a99-da44-436d-b7a0-2afc20a5f413,Whoami Utility Execution,2018-08-13,2025-10
159159
879c3015-c88b-4782-93d7-07adf92dbcb7,Space After Filename,2020-06-17,2025-11-22,low
160160
e710a880-1f18-4417-b6a0-b5afdf7e305a,Atomic MacOS Stealer - FileGrabber Infostealer Execution,2025-09-12,2025-11-22,high
161161
4be03877-d5b6-4520-85c9-a5911c0a656c,FileFix - Suspicious Child Process from Browser File Upload Abuse,2025-06-26,2025-11-24,high
162+
6e30c82f-a9f8-4aab-b79c-7c12bce6f248,File Download Via Bitsadmin To An Uncommon Target Folder,2022-06-28,2025-12-10,medium

‎deprecated/deprecated.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1118,5 +1118,12 @@
11181118
"date": "2025-06-26",
11191119
"modified": "2025-11-24",
11201120
"level": "high"
1121+
},
1122+
{
1123+
"id": "6e30c82f-a9f8-4aab-b79c-7c12bce6f248",
1124+
"title": "File Download Via Bitsadmin To An Uncommon Target Folder",
1125+
"date": "2022-06-28",
1126+
"modified": "2025-12-10",
1127+
"level": "medium"
11211128
}
11221129
]

‎regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/2b140a5c-dc02-4bb8-b6b1-8bdb45714cde.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/2b140a5c-dc02-4bb8-b6b1-8bdb45714cde.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Sysmon",
10+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
11+
}
12+
},
13+
"EventID": 7,
14+
"Version": 3,
15+
"Level": 4,
16+
"Task": 7,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2026-02-04T08:43:28.342637Z"
22+
}
23+
},
24+
"EventRecordID": 715282,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 776,
29+
"ThreadID": 4352
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-Sysmon/Operational",
33+
"Computer": "srv-01.midgardnet.tech",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"RuleName": "-",
42+
"UtcTime": "2026-02-04 08:43:28.234",
43+
"ProcessGuid": "14207D89-06B0-6983-CF01-000000004402",
44+
"ProcessId": 6672,
45+
"Image": "C:\\Users\\SwachchhandaP\\Downloads\\fsquirt.exe",
46+
"ImageLoaded": "C:\\Users\\SwachchhandaP\\Downloads\\bthprops.cpl",
47+
"FileVersion": "-",
48+
"Description": "-",
49+
"Product": "-",
50+
"Company": "-",
51+
"OriginalFileName": "-",
52+
"Hashes": "MD5=221877743CF329314E571E9398EFCA70,SHA256=863390BB749E466975A6A5330CCD077C846E1F387AAE0327AFFE33DF87153E67,IMPHASH=7FF91A855D5B3D338EB5B4CE63698F4A",
53+
"Signed": "false",
54+
"Signature": "-",
55+
"SignatureStatus": "Unavailable",
56+
"User": "MIDGARDNET\\SwachchhandaP"
57+
}
58+
}
59+
}

‎regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/info.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: 8ee57597-baba-46bd-8a61-85ff51f7aab6
2+
description: N/A
3+
date: 2026-02-04
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: 2b140a5c-dc02-4bb8-b6b1-8bdb45714cde
7+
title: System Control Panel Item Loaded From Uncommon Location
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
match_count: 1
13+
path: regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/2b140a5c-dc02-4bb8-b6b1-8bdb45714cde.evtx

‎regression_data/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly/e4a6b256-3e47-40fc-89d2-7a477edd6915.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly/e4a6b256-3e47-40fc-89d2-7a477edd6915.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Sysmon",
10+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
11+
}
12+
},
13+
"EventID": 1,
14+
"Version": 5,
15+
"Level": 4,
16+
"Task": 1,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2026-02-04T08:52:58.205267Z"
22+
}
23+
},
24+
"EventRecordID": 715573,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 776,
29+
"ThreadID": 4344
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-Sysmon/Operational",
33+
"Computer": "srv-01.midgardnet.tech",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"RuleName": "-",
42+
"UtcTime": "2026-02-04 08:52:58.203",
43+
"ProcessGuid": "14207D89-08EA-6983-2A02-000000004402",
44+
"ProcessId": 5696,
45+
"Image": "C:\\Users\\SwachchhandaP\\Downloads\\taskhost.exe",
46+
"FileVersion": "10.0.20348.1 (WinBuild.160101.0800)",
47+
"Description": "Windows Calculator",
48+
"Product": "Microsoft® Windows® Operating System",
49+
"Company": "Microsoft Corporation",
50+
"OriginalFileName": "CALC.EXE",
51+
"CommandLine": "taskhost.exe",
52+
"CurrentDirectory": "C:\\Users\\SwachchhandaP\\Downloads\\",
53+
"User": "MIDGARDNET\\SwachchhandaP",
54+
"LogonGuid": "14207D89-057C-6983-A047-0C0000000000",
55+
"LogonId": "0xc47a0",
56+
"TerminalSessionId": 2,
57+
"IntegrityLevel": "Medium",
58+
"Hashes": "MD5=1FD4DD58C75D6F2EDCDB337EE686231E,SHA256=4208893C871D2499F184E3F0F2554DA89F451FA9E98D95FC9516C5AE8F2B3BBD,IMPHASH=8EEAA9499666119D13B3F44ECD77A729",
59+
"ParentProcessGuid": "14207D89-08EA-6983-2902-000000004402",
60+
"ParentProcessId": 1816,
61+
"ParentImage": "C:\\Windows\\System32\\cmd.exe",
62+
"ParentCommandLine": "cmd /c taskhost.exe",
63+
"ParentUser": "MIDGARDNET\\SwachchhandaP"
64+
}
65+
}
66+
}

‎regression_data/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly/info.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: 0efa6f32-c1df-4053-91ca-cafc05416e79
2+
description: N/A
3+
date: 2026-02-04
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: e4a6b256-3e47-40fc-89d2-7a477edd6915
7+
title: System File Execution Location Anomaly
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
match_count: 1
13+
path: regression_data/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly/e4a6b256-3e47-40fc-89d2-7a477edd6915.evtx

‎regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/be58d2e2-06c8-4f58-b666-b99f6dc3b6cd.evtx‎

68 KB
Binary file not shown.

0 commit comments

Comments
 (0)