Goal

Detect a file on disk whose SHA256 hash has been identified as malicious or suspicious by threat intelligence.

Strategy

This rule monitors file activity events (OCSF class 2004) that include a file hash and checks whether that hash was enriched by threat intelligence with a malicious or suspicious intention and a SHA256 reputation match. A hash match against known malicious threat intel indicates the file itself is a known malicious artifact, regardless of which host or platform it was observed on.

Triage and response

• Identify the affected host and the full file path associated with the flagged hash {{@ocsf.evidences.file.hashes.value}}.
• Review the threat intel source and context for the hash match to understand the associated malware family or campaign, if known.
• Determine how the file arrived on the host (download, email attachment, removable media, lateral transfer) by reviewing surrounding process and file activity.
• Check whether the file was executed, and if so, investigate downstream process activity for signs of compromise.
• Isolate the affected host if execution or further spread is suspected, and collect the file for forensic analysis before removal.
• Search for the same hash across other hosts in the environment to determine the scope of exposure.