From 3255b012efcc005c52f2e9496819b06a167e50da Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 25 Feb 2022 15:23:46 +0100 Subject: [PATCH] Update windows_raw_access_to_master_boot_record_drive.yml --- .../endpoint/windows_raw_access_to_master_boot_record_drive.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index adfbca6f7a..762844f608 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to look for suspicious raw access read to drive where master boot record is place. +description: This analytic is to look for suspicious raw access read to drive where the master boot record is placed. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector. search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*"))