Query: rule covering Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.
Matching passage: Sigma rule: Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.. Logsource: windows / process_creation. Rule: title: System File Execution Location Anomaly id: e4a6b256-3e47-40fc-89d2-7a477edd6915 related: - id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd type: derived status: test description: 'Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location. ' references: - https://twitter.com/GelosSnake/status/934900723426439170 - https://asec.ahnlab.com/en/39828/ - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2017-11-27 modified: 2026-07-28 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \atbroker.exe - \audiodg.exe - \bcdedit.exe - \bitsadmin.exe - \certreq.exe - \certutil.exe - \cmstp.exe - \conhost.exe - \consent.exe - \cscript.exe - \csrss.exe - \dashost.exe - \defrag.exe - \dfrgui.exe - \dism.exe - \dllhost.exe - \dllhst3g.exe - \dwm.exe - \eventvwr.exe - \fsquirt.exe - \finger.exe - \logonui.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \ntoskrnl.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \runonce.exe - \RuntimeBroker.exe - \schtasks.exe - \services.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \userinit.exe - \werfault.exe - \werfaultsecure.exe - \wininit.exe - \winlogon.exe - \winver.exe - \wlanext.exe - \wmic.exe - \wscript.exe - \wsl.exe - \wsmprovhost.exe filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_optional_system32: Image|contains: \SystemRoot\System32\ filter_main_powershell: Image|contains: - C:\Program Files\PowerShell\7\ - C:\Program Files\PowerShell\7-preview\ - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_wsl_programfiles: Image|startswith: - C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux - C:\Program Files\WSL\ Image|endswith: \wsl.exe filter_main_wsl_appdata: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\WindowsApps\ Image|endswith: \wsl.exe c
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to per. Logsource: m365 / threat_management. Rule: title: Data Exfiltration to Unsanctioned Apps id: 2b669496-d215-47d8-bd9a-f4a45bf07cda status: test description: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1537 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Data exfiltration to unsanctioned apps status: success condition: selection falsepositives: - Unknown level: medium