Query: detect Detects the creation of binaries in the WinSxS folder by non-system processes in logs
Matching passage: Sigma rule: Detects the creation of binaries in the WinSxS folder by non-system processes. Logsource: windows / file_event. Rule: title: WinSxS Executable File Creation By Non-System Process id: 34746e8c-5fb8-415a-b135-0abc167e912a related: - id: 64827580-e4c3-4c64-97eb-c72325d45399 type: derived status: test description: Detects the creation of binaries in the WinSxS folder by non-system processes references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-11 tags: - attack.execution logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\WinSxS\ TargetFilename|endswith: .exe filter_main_system_location: Image|startswith: - C:\Windows\Systems32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter'. Logsource: windows / image_load. Rule: title: PowerShell Core DLL Loaded By Non PowerShell Process id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f related: - id: 867613fb-fa60-4497-a017-a82df74a172c type: obsolete - id: fe6e002f-f244-4278-9263-20e4b593827f type: obsolete status: test description: 'Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter''s "load powershell" extension. ' references: - https://adsecurity.org/?p=2921 - https://github.com/p3nt4/PowerShdll author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-11-14 modified: 2026-07-28 tags: - attack.t1059.001 - attack.execution logsource: category: image_load product: windows detection: selection: - Description: System.Management.Automation - OriginalFileName: System.Management.Automation.dll - ImageLoaded|endswith: - \System.Management.Automation.dll - \System.Management.Automation.ni.dll filter_main_powershell: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_pwsh_preview: Image|contains: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_generic: Image: - C:\Windows\System32\dsac.exe - C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe - C:\Windows\System32\runscripthelper.exe - C:\WINDOWS\System32\sdiagnhost.exe - C:\Windows\System32\ServerManager.exe - C:\Windows\System32\SyncAppvPublishingServer.exe - C:\Windows\System32\winrshost.exe - C:\Windows\System32\wsmprovhost.exe - C:\Windows\SysWOW64\winrshost.exe - C:\Windows\SysWOW64\wsmprovhost.exe filter_main_dotnet: Image|startswith: - C:\Windows\Microsoft.NET\Framework\ - C:\Windows\Microsoft.NET\FrameworkArm\ - C:\Windows\Microsoft.NET\FrameworkArm64\ - C:\Windows\Microsoft.NET\Framework64\ Image|endswith: \mscorsvw.exe filter_optional_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_optional_sql_server_mgmt: Image|startswith: - C:\Program Files (x86)\Microsoft SQL Server Management Studio - C:\Program Files\Microsoft SQL Server Management Studio Image|endswith: \IDE\