Onyx Sleet APT File Creation Indicator

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•22

Detects the creation of a specific file, 'inetmgr.exe', in the 'C:\Windows\ADFS\bg\' directory. This activity has been linked to the Onyx Sleet (also known as Andariel) APT group, particularly in the context of exploiting the TeamCity CVE-2023-42793 vulnerability.