Small Sieve Malware File Indicator Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

Detects the creation of specific files associated with the Small Sieve malware. This includes files with a characteristic typo ('Microsift' instead of 'Microsoft') in their path or a specific filename ('MicrosoftWindowsOutlookDataPlus.txt') in the AppData\Local directory, which are indicators of the Small Sieve malware's activity.