Sigma rules to detect CVE 2025 29824 and susp BLF File Creation #5260
Conversation
github-actions
bot
added
Rules
Windows
| selection_suspicious_paths_1: | ||
| TargetFilename|contains: | ||
| - ':\$Recycle.bin' | ||
| - ':\Perflogs' | ||
| - ':\ProgramData' | ||
| - ':\Temp' | ||
| - ':\Users\Default' | ||
| - ':\Users\public' | ||
| - ':\Windows\Temp' | ||
| - ':\Windows\addins' | ||
| - ':\Windows\Fonts' | ||
| - ':\Windows\IME' | ||
| - ':\Windows\System32\Tasks' | ||
| - ':\Windows\Tasks' | ||
| - '\config\systemprofile' | ||
| - '\AppData\Local\Temp' | ||
| - '\AppData\Roaming' | ||
| selection_suspicious_paths_user_1: | ||
| TargetFilename|contains: ':\Users\' | ||
| selection_suspicious_paths_user_2: | ||
| TargetFilename|contains: | ||
| - '\Contacts\' | ||
| - '\Documents\' | ||
| - '\Favorites\' | ||
| - '\Favourites\' | ||
| - '\Music\' | ||
| - '\Photos\' | ||
| - '\Pictures\' |
There was a problem hiding this comment.
.blf files should not be common so focusing on exclusion is far better than specifying a list that can be bypassed.
Also your list already contains FP such as C:\Users\Default\ and \config\systemprofile.
You cannot add a static list of potential susp paths without testing them first.
There was a problem hiding this comment.
If so, wouldn't using the exclusion increase the chances of false positives even more? we can only speculate as we don't have proper sets of env logs
There was a problem hiding this comment.
The FP that i mentioned are built-in hence can be found with a nice lab.
As for the logic to use exclusion is that argument that .blf are not that common (not in many random folders) and should be created by a set of expected processes. The FPs cannot be huge once you exclude the appropriate system dirs and files.
Because it is experimental and the level is not high. People would not be flooded and you can gather more data once its merged in.
| selection_path: | ||
| TargetFilename|contains: ':\ProgramData\SkyPDF\' | ||
| selection_image: | ||
| Image|endswith: '\dllhost.exe' |
There was a problem hiding this comment.
Who is the process that usually writes .blf files? Are you sure its not dllhost?
nasbench
added
Work In Progress
Summary of the Pull Request
Sigma rules to detect CVE 2025 29824 and susp BLF File Creation
Changelog
new: Potential Exploitation of CVE-2025-29824 - CLFS BLF File Creation (ET)
new: Suspicious BLF File Creation Outside System Directories
Example Log Event
Fixed Issues
SigmaHQ Rule Creation Conventions