Executable file dropped in Users\Public folder by SSH enabled copy software

Description

Executable file dropped in Users\Public folder by SSH enabled copy software

Query · wazuh

field win.eventdata.image="(?i)(scp|pscp|FZSFTP|sftp)\.exe"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 92207 Executable file dropped in Users\Public folder anchor level 12
    field win.eventdata.targetFilename="(?i)[c-z]:\\\\Users\\\\Public\\\\.*\.(exe|com|dll|vbs|js|bat|cmd|pif|wsh|ps1|lnk|msi|vbe)"
  2. 92208 Executable file dropped in Users\Public folder by SSH enabled copy software refinement level 15 this rule
    field win.eventdata.image="(?i)(scp|pscp|FZSFTP|sftp)\.exe"

Rule dependencies

Depends on

Raw source Executable file dropped in Users\Public folder by SSH enabled copy software · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="92208" level="15">
    <if_sid>92207</if_sid>
    <field name="win.eventdata.image" type="pcre2">(?i)(scp|pscp|FZSFTP|sftp)\.exe</field>
    <options>no_full_log</options>
    <description>Executable file dropped in Users\Public folder by SSH enabled copy software</description>
    <mitre>
      <id>T1105</id>
    </mitre>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.