Execution from Suspicious Folder

 1title: Execution from Suspicious Folder
 2id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4
 3status: test
 4description: Detects a suspicious execution from an uncommon folder
 5references:
 6    - https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt
 7    - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
 8    - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
 9    - https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md
10author: Florian Roth (Nextron Systems), Tim Shelton
11date: 2019/01/16
12modified: 2023/01/10
13tags:
14    - attack.defense_evasion
15    - attack.t1036
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection:
21        - Image|contains:
22              - '\$Recycle.bin\'
23              - '\config\systemprofile\'
24              - '\Intel\Logs\'
25              - '\RSA\MachineKeys\'
26              - '\Users\All Users\'
27              - '\Users\Default\'
28              - '\Users\NetworkService\'
29              - '\Users\Public\'
30              - '\Windows\addins\'
31              - '\Windows\debug\'
32              - '\Windows\Fonts\'
33              - '\Windows\Help\'
34              - '\Windows\IME\'
35              - '\Windows\Media\'
36              - '\Windows\repair\'
37              - '\Windows\security\'
38              - '\Windows\System32\Tasks\'
39              - '\Windows\Tasks\'
40        - Image|startswith: 'C:\Perflogs\'
41    filter_ibm:
42        Image|startswith: 'C:\Users\Public\IBM\ClientSolutions\Start_Programs\'
43    filter_citrix:
44        Image|startswith: 'C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\'
45        Image|endswith: '\CitrixReceiverUpdater.exe'
46    condition: selection and not 1 of filter_*
47fields:
48    - CommandLine
49    - ParentCommandLine
50falsepositives:
51    - Unknown
52level: high

References

• appcompatprocessor/AppCompatSearch.txt at 6c847937c5a836e2ce2fe2b915f213c345a3c389 · mbevilacqua/appcompatprocessor

  

  "Evolving AppCompat/AmCache data analysis beyond grep" - mbevilacqua/appcompatprocessor

  
  Read More

• BRONZE BUTLER Hacker Group Targets Japanese Enterprises

  

  Read the Secureworks CTU Threat Intelligence on BRONZE BUTLER, reviewing both the strategy and tactics of the threat group.

  
  Read More

• CrowdStrike 2024 Global Threat Report | CrowdStrike

  

  Summarizing a year defined by adversarial stealth, the highly anticipated CrowdStrike 2024 Global Threat Report uncovers notable themes, trends, and events.

  
  Read More

• ThreatHunting/hunts/suspicious_process_creation_via_windows_event_logs.md at cb22598bb70651f88e0285abc8d835757d2cb596 · ThreatHuntingProject/ThreatHunting

  

  An informational repo about hunting for adversaries in your IT environment. - ThreatHuntingProject/ThreatHunting

  
  Read More

Related rules

• Renamed Plink Execution
• Suspicious Windows Update Agent Empty Cmdline
• Suspicious Calculator Usage
• System File Execution Location Anomaly
• Explorer Process Tree Break