Suspicious File Characteristics Due to Missing Fields

Title: Suspicious File Characteristics Due to Missing Fields
Status: test
Description:Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe
References:
  -https://securelist.com/muddywater/88059/
  -https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection
Author: Markus Neis, Sander Wiebing
Date: 2018-11-22
modified:2022-10-09
Tags:

• -'attack.execution'
• -'attack.t1059.006'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection1:
    Description: '\?'
    FileVersion: '\?'
  selection2:
    Description: '\?'
    Product: '\?'
  selection3:
    Description: '\?'
    Company: '\?'
  folder:
    Image|contains: '\Downloads\'
  condition:(selection1 or selection2 or selection3) and folder
Falsepositives:
  -Unknown
Level: medium