Query: detect Detects a potentially suspicious execution from an uncommon folder. in logs
Matching passage: Sigma rule: Detects a potentially suspicious execution from an uncommon folder.. Logsource: windows / process_creation. Rule: title: Process Execution From A Potentially Suspicious Folder id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4 status: test description: Detects a potentially suspicious execution from an uncommon folder. references: - https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ - https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md author: Florian Roth (Nextron Systems), Tim Shelton date: 2019-01-16 modified: 2024-07-12 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Perflogs\ - :\Users\All Users\ - :\Users\Default\ - :\Users\NetworkService\ - :\Windows\addins\ - :\Windows\debug\ - :\Windows\Fonts\ - :\Windows\Help\ - :\Windows\IME\ - :\Windows\Media\ - :\Windows\repair\ - :\Windows\security\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - $Recycle.bin - \config\systemprofile\ - \Intel\Logs\ - \RSA\MachineKeys\ filter_optional_ibm: Image|startswith: C:\Users\Public\IBM\ClientSolutions\Start_Programs\ filter_optional_citrix: Image|startswith: C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\ Image|endswith: \CitrixReceiverUpdater.exe condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something un. Logsource: windows / registry_set. Rule: title: Uncommon Microsoft Office Trusted Location Added id: f742bde7-9528-42e5-bd82-84f51a8387d2 related: - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac type: derived status: test description: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions. references: - Internal Research - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-21 modified: 2023-09-29 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Security\Trusted Locations\Location TargetObject|endswith: \Path filter_exclude_known_paths: Details|contains: - '%APPDATA%\Microsoft\Templates' - '%%APPDATA%%\Microsoft\Templates' - '%APPDATA%\Microsoft\Word\Startup' - '%%APPDATA%%\Microsoft\Word\Startup' - :\Program Files (x86)\Microsoft Office\root\Templates\ - :\Program Files\Microsoft Office (x86)\Templates - :\Program Files\Microsoft Office\root\Templates\ - :\Program Files\Microsoft Office\Templates\ filter_main_office_click_to_run: Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_office_apps: Image|contains: - :\Program Files\Microsoft Office\ - :\Program Files (x86)\Microsoft Office\ condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_* falsepositives: - Other unknown legitimate or custom paths need to be filtered to avoid false positives level: high