Arbitrary File Download Via IMEWDBLD.EXE

Rule Info

Name
Arbitrary File Download Via IMEWDBLD.EXE
Author
Swachchhanda Shrawan Poudel
Description
Detects usage of "IMEWDBLD.exe" to download arbitrary files
Reference
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download
Date
2023-11-09 00:00:00
Modified
None
Id
863218bd-c7d0-4c52-80cd-0a96c09f54af
Tags
attack.defense-evasion attack.execution attack.t1218 DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=863218bd-c7d0-4c52-80cd-0a96c09f54af

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
Swachchhanda Shrawan Poudel
Merge PR #4557 from @swachchhanda000 - Multiple Rule Updates & New Rules
2023-11-14
fc716d14f
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022