Suspicious IO.FileStream

testmedium
log source: windows · ps_scriptauthor frack113date 2022-01-09
01

description

What this is, in brief.

Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.

02

tags

attack.stealthattack.t1070.003
03

rule source (YAML)

title: Suspicious IO.FileStream
id: 70ad982f-67c8-40e0-a955-b920c2fa05cb
status: test
description: Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1006/T1006.md
author: frack113
date: 2022-01-09
modified: 2022-03-05
tags:
    - attack.stealth
    - attack.t1070.003
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - New-Object
            - IO.FileStream
            - '\\\\.\\'
    condition: selection
falsepositives:
    - Legitimate PowerShell scripts
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_iofilestream/info.yml
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.