Log source category
file_access log source Sigma rules
13 Sigma detection rules in the library use the file_access log source, mostly on windows. The file_access category groups related telemetry so you can find detections that consume the same events. Open a rule to read its detection logic, MITRE ATT&CK mapping and original YAML.
Access To Crypto Currency Wallets By Uncommon Applications
mediumDetects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing.
windows
Access To Potentially Sensitive Sysvol Files By Uncommon Applications
mediumDetects file access requests to potentially sensitive files hosted on the Windows Sysvol share.
windows
Access To Sysvol Policies Share By Uncommon Process
mediumDetects file access requests to the Windows Sysvol Policies Share by uncommon processes
windows
Access To Windows Credential History File By Uncommon Applications
mediumDetects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
windows
Access To Windows DPAPI Master Keys By Uncommon Applications
mediumDetects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function
windows
Credential Manager Access By Uncommon Applications
mediumDetects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
windows
Microsoft Teams Sensitive File Access By Uncommon Applications
mediumDetects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.
windows
Access To .Reg/.Hive Files By Uncommon Applications
lowDetects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.
windows
Access To Browser Credential Files By Uncommon Applications
lowDetects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing. Requires heavy baselining before usage
windows
Access To Chromium Browsers Sensitive Files By Uncommon Applications
lowDetects file access requests to chromium based browser sensitive files by uncommon processes. Could indicate potential attempt of stealing sensitive information.
windows
Access To Windows Outlook Mail Files By Uncommon Applications
lowDetects file access requests to Windows Outlook Mail by uncommon processes. Could indicate potential attempt of credential stealing. Requires heavy baselining before usage
windows
Suspicious File Access to Browser Credential Storage
lowDetects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.
windows
Unattend.XML File Access Attempt
lowDetects attempts to access the "unattend.xml" file, where credentials might be stored. This file is used during the unattended windows install process.
windows