Legitimate Application Dropped Executable

 1title: Legitimate Application Dropped Executable
 2id: f0540f7e-2db3-4432-b9e0-3965486744bc
 3status: test
 4description: |
 5    Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk.
 6    This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.    
 7references:
 8    - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326
 9    - https://dmpdump.github.io/posts/TelegramRat/
10    - https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior
11author: frack113, Florian Roth (Nextron Systems)
12date: 2022-08-21
13modified: 2026-05-11
14tags:
15    - attack.stealth
16    - attack.t1218
17logsource:
18    product: windows
19    category: file_event
20detection:
21    selection:
22        Image|endswith:
23            # Microsoft Office Programs Dropping Executables / Rest of the apps are covered in: c7a74c80-ba5a-486e-9974-ab9e682bc5e4
24            - '\eqnedt32.exe'
25            - '\wordpad.exe'
26            - '\wordview.exe'
27            # LOLBINs that can be used to download executables
28            - '\certutil.exe'
29            - '\certoc.exe'
30            - '\CertReq.exe'
31            # - \bitsadmin.exe (depends on the environment; comment in if you're sure that bitsadmin doesn't do that in your env)
32            - '\Desktopimgdownldr.exe'
33            - '\esentutl.exe'
34            # - \expand.exe
35            - '\mshta.exe'
36            # Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)
37            - '\AcroRd32.exe'
38            - '\RdrCEF.exe'
39            - '\hh.exe'
40            - '\finger.exe'
41        TargetFilename|endswith:
42            - '.com'
43            - '.dll'
44            - '.exe'
45            - '.jar'
46            - '.ocx'
47            - '.pyc'
48    condition: selection
49falsepositives:
50    - Unknown
51level: high
52regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe/info.yml