Query: detection rule: Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW
Matching passage: Sigma rule: Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW. Logsource: windows / file_event. Rule: title: Files With System Process Name In Unsuspected Locations id: d5866ddf-ce8f-4aea-b28e-d96485a20d3d status: test description: 'Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production. ' references: - Internal Research author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2020-05-26 modified: 2026-07-28 tags: - attack.stealth - attack.t1036.005 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \AtBroker.exe - \audiodg.exe - \backgroundTaskHost.exe - \bcdedit.exe - \bitsadmin.exe - \cmdl32.exe - \cmstp.exe - \conhost.exe - \csrss.exe - \dasHost.exe - \dfrgui.exe - \dllhost.exe - \dwm.exe - \eventcreate.exe - \eventvwr.exe - \explorer.exe - \extrac32.exe - \fontdrvhost.exe - \fsquirt.exe - \ipconfig.exe - \iscsicli.exe - \iscsicpl.exe - \logman.exe - \LogonUI.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \msinfo32.exe - \mstsc.exe - \nbtstat.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regini.exe - \regsvr32.exe - \rundll32.exe - \RuntimeBroker.exe - \schtasks.exe - \SearchFilterHost.exe - \SearchIndexer.exe - \SearchProtocolHost.exe - \SecurityHealthService.exe - \SecurityHealthSystray.exe - \services.exe - \ShellAppRuntime.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \SystemSettingsBroker.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \TiWorker.exe - \vssadmin.exe - \w32tm.exe - \WerFault.exe - \WerFaultSecure.exe - \wermgr.exe - \wevtutil.exe - \wininit.exe - \winlogon.exe - \winrshost.exe - \WinRTNetMUAHostServer.exe - \wlanext.exe - \wlrmdr.exe - \WmiPrvSE.exe - \wslhost.exe - \WSReset.exe - \WUDFHost.exe - \WWAHost.exe filter_main_generic: TargetFilename|contains: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\Windows\uus\ filter_main_tiworker: Image|endswith: - \TiWorker.exe - \wuaucltcore.exe TargetFilename|startswith: C:\Windows\Temp\ filter_main_svchost: Image|endswith: - C:\Windows\system32\svchost.exe - C:\Windows\SysWOW64\svchost.exe TargetFilename|contains: - C:\Program Files\WindowsApps\ - C:\Program Files (x86)\WindowsApps\ - \AppData\Local\Microsoft\WindowsApps\ filter_main_wuauclt: Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\Sy
Near-miss passage: Sigma rule: Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credenti. Logsource: windows / security. Rule: title: Potentially Suspicious Explicit Credential Local Logon id: e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62 status: experimental description: 'Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account. ' references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1134.003 logsource: product: windows service: security detection: selection_eid: EventID: 4648 selection_localhost: - TargetServerName: localhost - TargetInfo: localhost - IpAddress: - 127.0.0.1 - ::1 filter_main_computer_accounts: SubjectUserName|endswith: $ filter_main_system_processes: ProcessName|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: ProcessName|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_same_user: SubjectUserName|fieldref: TargetUserName condition: all of selection_* and not 1 of filter_main_* falsepositives: - RunAs usage from user-installed applications outside Program Files - Administrative scripts using explicit credentials from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/builtin/security/win_security_explicit_credential_local_logon/info.yml