Process Execution From A Potentially Suspicious Folder

calendar Aug 12, 2024 · attack.defense-evasion attack.t1036  ·
Share on: linkedin copy

Detects a potentially suspicious execution from an uncommon folder.

Sigma rule (View on GitHub)

 1title: Process Execution From A Potentially Suspicious Folder
 2id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4
 3status: test
 4description: Detects a potentially suspicious execution from an uncommon folder.
 5references:
 6    - https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt
 7    - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
 8    - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
 9    - https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md
10author: Florian Roth (Nextron Systems), Tim Shelton
11date: 2019-01-16
12modified: 2024-07-12
13tags:
14    - attack.defense-evasion
15    - attack.t1036
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection:
21        Image|contains:
22            - ':\Perflogs\'
23            - ':\Users\All Users\'
24            - ':\Users\Default\'
25            - ':\Users\NetworkService\'
26            - ':\Windows\addins\'
27            - ':\Windows\debug\'
28            - ':\Windows\Fonts\'
29            - ':\Windows\Help\'
30            - ':\Windows\IME\'
31            - ':\Windows\Media\'
32            - ':\Windows\repair\'
33            - ':\Windows\security\'
34            - ':\Windows\System32\Tasks\'
35            - ':\Windows\Tasks\'
36            - '$Recycle.bin'
37            - '\config\systemprofile\'
38            - '\Intel\Logs\'
39            - '\RSA\MachineKeys\'
40    filter_optional_ibm:
41        Image|startswith: 'C:\Users\Public\IBM\ClientSolutions\Start_Programs\'
42    filter_optional_citrix:
43        Image|startswith: 'C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\'
44        Image|endswith: '\CitrixReceiverUpdater.exe'
45    condition: selection and not 1 of filter_optional_*
46falsepositives:
47    - Unknown
48level: high

References

Related rules

to-top