Unusual File Deletion by Dns.exe
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "File deleted" AND PROCESSNAME endswith "\dns.exe" AND (FILENAME notendswith "\dns.log" AND OBJECTNAME notendswith "\dns.log") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.PROCESSNAME,Action1.ACCESSLIST,Action1.OBJECTNAME,Action1.FILENAME,Action1.FILETYPE
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Tim Rauch (Nextron Systems), Elastic (idea)
