Query: rule covering Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could
Matching passage: Sigma rule: Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Windows App Activity id: f91ed517-a6ba-471d-9910-b3b4a398c0f3 status: test description: Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution references: - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-12 modified: 2025-10-07 tags: - attack.stealth logsource: product: windows category: process_creation detection: selection_parent: ParentImage|contains: C:\Program Files\WindowsApps\ selection_susp_img: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_susp_cli: CommandLine|contains: - cmd /c - Invoke- - Base64 filter_optional_terminal: ParentImage|contains: :\Program Files\WindowsApps\Microsoft.WindowsTerminal ParentImage|endswith: \WindowsTerminal.exe Image|endswith: - \powershell.exe - \cmd.exe - \pwsh.exe filter_optional_sysinternals: ParentImage|startswith: C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite Image|endswith: \cmd.exe condition: selection_parent and 1 of selection_susp_* and not 1 of filter_optional_* falsepositives: - Legitimate packages that make use of external binaries such as Windows Terminal level: medium
Near-miss passage: Sigma rule: Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system. Logsource: windows / process_creation. Rule: title: Set Suspicious Files as System Files Using Attrib.EXE id: efec536f-72e8-4656-8960-5e85d091345b related: - id: bb19e94c-59ae-4c15-8c12-c563d23fe52b type: derived status: test description: 'Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs ' references: - https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4 - https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0 - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-03-14 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \attrib.exe - OriginalFileName: ATTRIB.EXE selection_cli: CommandLine|contains: ' +s' selection_paths: CommandLine|contains: - ' %' - \Users\Public\ - \AppData\Local\ - \ProgramData\ - \Downloads\ - \Windows\Temp\ selection_ext: CommandLine|contains: - .bat - .dll - .exe - .hta - .ps1 - .vbe - .vbs filter_optional_installer: CommandLine|contains|all: - \Windows\TEMP\ - .exe condition: all of selection* and not 1 of filter_optional_* falsepositives: - Unknown level: high