Query: rule covering Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for ap
Matching passage: Sigma rule: Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for ap. Logsource: windows / file_event. Rule: title: Legitimate Application Writing Files In Uncommon Location id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67 related: - id: 2ddef153-167b-4e89-86b6-757a9e65dcac type: similar status: experimental description: 'Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions. ' references: - https://lolbas-project.github.io/#/download author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-10 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: product: windows category: file_event detection: selection_img: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \cmdl32.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \bitsadmin.exe - \Desktopimgdownldr.exe - \esentutl.exe - \expand.exe - \extrac32.exe - \replace.exe - \mshta.exe - \ftp.exe - \Ldifde.exe - \RdrCEF.exe - \hh.exe - \finger.exe - \findstr.exe selection_locations: TargetFilename|contains: - :\Perflogs - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\ - \$Recycle.Bin\ - \AppData\Local\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/info.yml
Near-miss passage: Sigma rule: This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that. Logsource: windows / security. Rule: title: Account Tampering - Suspicious Failed Logon Reasons id: 9eb99343-d336-4020-a3cd-67f3819e68ee status: test description: This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625 - https://twitter.com/SBousseaden/status/1101431884540710913 author: Florian Roth (Nextron Systems) date: 2017-02-19 modified: 2025-10-17 tags: - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1078 logsource: product: windows service: security detection: selection_eid: EventID: - 4625 - 4776 selection_status: - Status: - '0xC0000072' - '0xC000006F' - '0xC0000070' - '0xC0000413' - '0xC000018C' - '0xC000015B' - SubStatus: - '0xC0000072' - '0xC000006F' - '0xC0000070' - '0xC0000413' - '0xC000018C' - '0xC000015B' filter: SubjectUserSid: S-1-0-0 condition: all of selection_* and not filter falsepositives: - User using a disabled account level: medium