VHD Image Download Via Browser

Title: VHD Image Download Via Browser
Status: test
Description:Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.
References:
  -https://redcanary.com/blog/intelligence-insights-october-2021/
  -https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/
  -https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
Date: 2021-10-25
modified:2023-05-05
Tags:

• -'attack.resource-development'
• -'attack.t1587.001'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    Image|endswith:
      -'\brave.exe'
      -'\chrome.exe'
      -'\firefox.exe'
      -'\iexplore.exe'
      -'\maxthon.exe'
      -'\MicrosoftEdge.exe'
      -'\msedge.exe'
      -'\msedgewebview2.exe'
      -'\opera.exe'
      -'\safari.exe'
      -'\seamonkey.exe'
      -'\vivaldi.exe'
      -'\whale.exe'

    TargetFilename|contains: '.vhd'
  condition:selection
Falsepositives:
  -Legitimate downloads of ".vhd" files would also trigger this
Level: medium