windows_new_file_relevant_infection_path.conf

{
  "platform": "windows",
  "description": "ATT&CK: T1034,T1074,T1044,T1060,T1023",
  "queries": {
    "windows_new_file": {
        "query": "SELECT hash.md5, path, file.filename, datetime(file.btime, 'unixepoch', 'UTC') as btime, datetime(file.atime, 'unixepoch', 'UTC') as atime, datetime(file.ctime, 'unixepoch', 'UTC') as ctime, datetime(file.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file USING (path) where path like 'C:\\Windows\\%' and type='regular';",
        "interval": 1800,
        "description": "Check suspicious file creation under c:\\windows - ATT&CK T1034,T1074,T1044",
        "platform": "windows",
        "removed": false
        },
    "windows_temp": {
        "query": "SELECT hash.md5, path, file.filename, datetime(file.btime, 'unixepoch', 'UTC') as btime, datetime(file.atime, 'unixepoch', 'UTC') as atime, datetime(file.ctime, 'unixepoch', 'UTC') as ctime, datetime(file.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file USING (path) where path like 'C:\\Windows\\temp\\%' and type='regular';",
        "interval": 1820,
        "description": "Check suspicious file creation under c:\\windows\\temp - ATT&CK T1034,T1074,T1044",
        "platform": "windows",
        "removed": false
        },
    "AppData_Roaming": {
        "query": "SELECT hash.md5, path, file.filename, datetime(file.btime, 'unixepoch', 'UTC') as btime, datetime(file.atime, 'unixepoch', 'UTC') as atime, datetime(file.ctime, 'unixepoch', 'UTC') as ctime, datetime(file.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file USING (path) where path like 'C:\\users\\%\\AppData\\Roaming\\%' and type='regular';",
        "interval": 1840,
        "description": "Check suspicious file creation under %APPDATA% or %\\AppData\\Roaming - ATT&CK T1034,T1074,T1044",
        "platform": "windows",
        "removed": false
        },
    "AppData_Local": {
        "query": "SELECT hash.md5, path, file.filename, datetime(file.btime, 'unixepoch', 'UTC') as btime, datetime(file.atime, 'unixepoch', 'UTC') as atime, datetime(file.ctime, 'unixepoch', 'UTC') as ctime, datetime(file.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file USING (path) where path like 'C:\\users\\%\\AppData\\Local\\%' and type='regular';",
        "interval": 1860,
        "description": "Check suspicious file creation under AppData\\Local - ATT&CK T1034,T1074,T1044",
        "platform": "windows",
        "removed": false
        },
    "AppData_Local_temp": {
        "query": "SELECT hash.md5, path, file.filename, datetime(file.btime, 'unixepoch', 'UTC') as btime, datetime(file.atime, 'unixepoch', 'UTC') as atime, datetime(file.ctime, 'unixepoch', 'UTC') as ctime, datetime(file.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file USING (path) where path like 'C:\\users\\%\\AppData\\Local\\temp\\%' and type='regular';",
        "interval": 1900,
        "description": "Check suspicious file creation under %TEMP% or AppData\\Local\\Temp - ATT&CK T1034,T1074,T1044",
        "platform": "windows",
        "removed": false
        },
    "User_StartMenu_startup": {
	"query": "SELECT hash.md5, path, file.filename, datetime(file.btime, 'unixepoch', 'UTC') as btime, datetime(file.atime, 'unixepoch', 'UTC') as atime, datetime(file.ctime, 'unixepoch', 'UTC') as ctime, datetime(file.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file USING (path) where path like 'C:\\users\\%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\%' AND type='regular';",
	"interval": 1860,
	"description": "Check suspicious file creation under Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup - ATT&CK T1060,T1023",
	"platform": "windows",
	"removed": false
	},
    "User_StartMenu_program": {
	"query": "SELECT hash.md5, path, file.filename, datetime(file.btime, 'unixepoch', 'UTC') as btime, datetime(file.atime, 'unixepoch', 'UTC') as atime, datetime(file.ctime, 'unixepoch', 'UTC') as ctime, datetime(file.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file USING (path) where path like 'C:\\users\\%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\%' AND type='regular';",
	"interval": 1860,
	"description": "Check suspicious file creation under Roaming\\Microsoft\\Windows\\Start Menu\\Programs - ATT&CK T1060,T1023",
	"platform": "windows",
	"removed": false
	},
    "Programmata_StartMenu": {
	"query": "SELECT hash.md5, path, file.filename, datetime(file.btime, 'unixepoch', 'UTC') as btime, datetime(file.atime, 'unixepoch', 'UTC') as atime, datetime(file.ctime, 'unixepoch', 'UTC') as ctime, datetime(file.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file USING (path) where path like 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\%' AND type='regular';",
	"interval": 1860,
	"description": "Check suspicious file creation under ProgramData\\Microsoft\\Windows\\Start Menu - ATT&CK T1060,T1023",
	"platform": "windows",
	"removed": false
	},
    "Programmata_StartMenu_program": {
	"query": "SELECT hash.md5, path, file.filename, datetime(file.btime, 'unixepoch', 'UTC') as btime, datetime(file.atime, 'unixepoch', 'UTC') as atime, datetime(file.ctime, 'unixepoch', 'UTC') as ctime, datetime(file.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file USING (path) where path like 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\%' AND type='regular';",
	"interval": 1860,
	"description": "Check suspicious file creation under ProgramData\\Microsoft\\Windows\\Start Menu\\Programs - ATT&CK T1060,T1023",
	"platform": "windows",
	"removed": false
	}
   }
}