Uncommon FileSystem Load Attempt By Format.com
This rule detects the execution of 'format.com' with a command-line argument specifying a file system type that is not commonly used. The intent is to identify potential defense evasion activities where 'format.com' might be leveraged to load malicious DLL files or other programs by manipulating its file system handling capabilities. The rule specifically filters out common file system types like exFAT, FAT, NTFS, ReFS, and UDF, flagging any other '/fs:' argument as suspicious.
Sigma
