Query: alert when Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directori
Matching passage: Sigma rule: Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directori. Logsource: windows / process_creation. Rule: title: LOL-Binary Copied From System Directory id: f5d19838-41b5-476c-98d8-ba8af4929ee2 related: - id: fff9d2b7-e11c-4a69-93d3-40ef66189767 type: derived status: test description: 'Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations. ' references: - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/ - https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-29 modified: 2025-11-27 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_tools_cmd: Image|endswith: \cmd.exe CommandLine|contains: 'copy ' selection_tools_pwsh: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - copy-item - ' copy ' - 'cpi ' - ' cp ' selection_tools_other: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_target_path: CommandLine|contains: - \System32 - \SysWOW64 - \WinSxS selection_target_lolbin: CommandLine|contains: - \bitsadmin.exe - \calc.exe - \certutil.exe - \cmdl32.exe - \cscript.exe - \mshta.exe - \rundll32.exe - \wscript.exe - \ie4uinit.exe condition: 1 of selection_tools_* and all of selection_target_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change m. Logsource: windows / registry_set. Rule: title: New Netsh Helper DLL Registered From A Suspicious Location id: e7b18879-676e-4a0e-ae18-27039185a8e7 related: - id: 56321594-9087-49d9-bf10-524fe8479452 type: similar - id: c90362e0-2df3-4e61-94fe-b37615814cb1 type: similar status: test description: 'Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper ' references: - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-11-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.007 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: \SOFTWARE\Microsoft\NetSh selection_folders_1: Details|contains: - :\Perflogs\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \Temporary Internet selection_folders_2: - Details|contains|all: - :\Users\ - \Favorites\ - Details|contains|all: - :\Users\ - \Favourites\ - Details|contains|all: - :\Users\ - \Contacts\ - Details|contains|all: - :\Users\ - \Pictures\ condition: selection_target and 1 of selection_folders_* falsepositives: - Unknown level: high