Query: Sigma rule for Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.
Matching passage: Sigma rule: Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.. Logsource: windows / process_creation. Rule: title: System File Execution Location Anomaly id: e4a6b256-3e47-40fc-89d2-7a477edd6915 related: - id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd type: derived status: test description: 'Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location. ' references: - https://twitter.com/GelosSnake/status/934900723426439170 - https://asec.ahnlab.com/en/39828/ - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2017-11-27 modified: 2026-07-28 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \atbroker.exe - \audiodg.exe - \bcdedit.exe - \bitsadmin.exe - \certreq.exe - \certutil.exe - \cmstp.exe - \conhost.exe - \consent.exe - \cscript.exe - \csrss.exe - \dashost.exe - \defrag.exe - \dfrgui.exe - \dism.exe - \dllhost.exe - \dllhst3g.exe - \dwm.exe - \eventvwr.exe - \fsquirt.exe - \finger.exe - \logonui.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \ntoskrnl.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \runonce.exe - \RuntimeBroker.exe - \schtasks.exe - \services.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \userinit.exe - \werfault.exe - \werfaultsecure.exe - \wininit.exe - \winlogon.exe - \winver.exe - \wlanext.exe - \wmic.exe - \wscript.exe - \wsl.exe - \wsmprovhost.exe filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_optional_system32: Image|contains: \SystemRoot\System32\ filter_main_powershell: Image|contains: - C:\Program Files\PowerShell\7\ - C:\Program Files\PowerShell\7-preview\ - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_wsl_programfiles: Image|startswith: - C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux - C:\Program Files\WSL\ Image|endswith: \wsl.exe filter_main_wsl_appdata: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\WindowsApps\ Image|endswith: \wsl.exe c
Near-miss passage: Sigma rule: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ". Logsource: windows / file_event. Rule: title: SCR File Write Event id: c048f047-7e2a-4888-b302-55f509d4a91d status: test description: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example. references: - https://lolbas-project.github.io/lolbas/Libraries/Desk/ author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2022-04-27 modified: 2023-08-23 tags: - attack.stealth - attack.t1218.011 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: .scr filter: TargetFilename|contains: - :\$WINDOWS.~BT\NewOS\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ - :\WUDownloadCache\ condition: selection and not filter falsepositives: - The installation of new screen savers by third party software level: medium