Suspicious Process Execution From Fake Recycle.Bin Folder
Detects process execution from a fake recycle bin folder, often used to avoid security solution.
Sigma rule (View on GitHub)
1title: Suspicious Process Execution From Fake Recycle.Bin Folder
2id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0
3related:
4 - id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca
5 type: derived
6status: experimental
7description: Detects process execution from a fake recycle bin folder, often used to avoid security solution.
8references:
9 - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets
10 - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
11author: X__Junior (Nextron Systems)
12date: 2023/07/12
13modified: 2023/11/06
14tags:
15 - attack.persistence
16 - attack.defense_evasion
17logsource:
18 category: process_creation
19 product: windows
20detection:
21 selection:
22 Image|contains:
23 # e.g. C:\$RECYCLER.BIN
24 - 'RECYCLERS.BIN\'
25 - 'RECYCLER.BIN\'
26 - 'RECYCLE.BIN\'
27 condition: selection
28falsepositives:
29 - Unknown
30level: high
References
Related rules
- Suspicious File Creation Activity From Fake Recycle.Bin Folder
- Potential Persistence Via Security Descriptors - ScriptBlock
- Potential Suspicious Activity Using SeCEdit
- Suspicious Execution via macOS Script Editor
- Triple Cross eBPF Rootkit Default Persistence