name: Suspicious access to Unattended Panther files
id: d305fb15-6ad1-4d61-a84b-ada462f23a55
version: 1.0.0
description: |
  Identifies suspicious to access to unattend.xml files where credentials
  are commonly stored within the Panther directory. Adversaries may search local
  file systems and remote file shares for files containing insecurely stored credentials.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1552
  technique.name: Unsecured credentials
  technique.ref: https://attack.mitre.org/techniques/T1552/
  subtechnique.id: T1552.001
  subtechnique.name: Credentials In Files
  subtechnique.ref: https://attack.mitre.org/techniques/T1552/001/

condition: >
  open_file
    and
  file.name imatches
    (
      '?:\\Windows\\Panther\\Unattend\\Unattended.xml',
      '?:\\Windows\\Panther\\Unattend\\Unattend.xml',
      '?:\\Windows\\Panther\\Unattended.xml',
      '?:\\Windows\\Panther\\Unattend.xml'
    )
    and
    not
  ps.exe imatches
    (
      '?:\\Program Files\\*',
      '?:\\Program Files(x86)\\*',
      '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe'
    )

min-engine-version: 2.0.0
