In the preceding investigation use case, a custom IOC rule triggers an alert. An example of this rule is provided below.
{ "996e15a7-9962-4d98-b2cf-281d3cdf3490": {
"name": "Demo - Invoice 01",
"uri_name": "996e15a7-9962-4d98-b2cf-281d3cdf3490",
"category": "Custom", "platforms": [
"win"
],
"description": "Test detection with exclusions ",
"create_text": "Steen",
"execution": [],
"presence": [
[
{
"operator": "contains",
"token": "fileWriteEvent/fileName",
"type": "text",
"value": "invoice"
},
{
"operator": "contains",
"token": "fileWriteEvent/filePath",
"type": "text",
"value": "\\roaming\\microsoft\\windows\\recent",
"negate": true
},
{
"operator": "contains",
"token": "fileWriteEvent/fileName",
"type": "text",
"value": ":zone.identifier",
"negate": true
}
]
]
}
}