Sigma Rule Library

Lace Tempest File Indicators

Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7

View on GitHubOpen raw file

Detection logic

selection

- TargetFilename|endswith:
    - :\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe
    - :\Program Files\SysAidServer\tomcat\webapps\usersfiles.war
    - :\Program Files\SysAidServer\tomcat\webapps\leave
- TargetFilename|contains: :\Program Files\SysAidServer\tomcat\webapps\user.

Condition

selection

Raw YAML

title: Lace Tempest File Indicators
id: e94486ea-2650-4548-bf25-88cbd0bb32d7
status: test
description: Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7
references:
    - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-11-09
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        - TargetFilename|endswith:
              - ':\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe'
              - ':\Program Files\SysAidServer\tomcat\webapps\usersfiles.war'
              - ':\Program Files\SysAidServer\tomcat\webapps\leave'
        - TargetFilename|contains: ':\Program Files\SysAidServer\tomcat\webapps\user.'
    condition: selection
falsepositives:
    - Unlikely
level: high

False positives

  • Unlikely

References

Similar rules

CVE-2021-1675 Print Spooler Exploitation Filename Pattern

critical

windows · Same logsource category (file_event)

CVE-2021-26858 Exchange Exploitation

high

windows · Same logsource category (file_event)

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

critical

windows · Same logsource category (file_event)

CVE-2021-44077 POC Default Dropped File

high

windows · Same logsource category (file_event)