Query: detection rule: Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directori
Matching passage: Sigma rule: Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directori. Logsource: windows / process_creation. Rule: title: LOL-Binary Copied From System Directory id: f5d19838-41b5-476c-98d8-ba8af4929ee2 related: - id: fff9d2b7-e11c-4a69-93d3-40ef66189767 type: derived status: test description: 'Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations. ' references: - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/ - https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-29 modified: 2025-11-27 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_tools_cmd: Image|endswith: \cmd.exe CommandLine|contains: 'copy ' selection_tools_pwsh: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - copy-item - ' copy ' - 'cpi ' - ' cp ' selection_tools_other: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_target_path: CommandLine|contains: - \System32 - \SysWOW64 - \WinSxS selection_target_lolbin: CommandLine|contains: - \bitsadmin.exe - \calc.exe - \certutil.exe - \cmdl32.exe - \cscript.exe - \mshta.exe - \rundll32.exe - \wscript.exe - \ie4uinit.exe condition: 1 of selection_tools_* and all of selection_target_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects loading of known malicious drivers via the file name of the drivers.. Logsource: windows / driver_load. Rule: title: Malicious Driver Load By Name id: 39b64854-5497-4b57-a448-40977b8c9679 status: test description: Detects loading of known malicious drivers via the file name of the drivers. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-03 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: ImageLoaded|endswith: - \wfshbr64.sys - \ktmutil7odm.sys - \ktes.sys - \a26363e7b02b13f2b8d697abb90cd5c3.sys - \kt2.sys - \4748696211bd56c2d93c21cab91e82a5.sys - \malicious.sys - \a236e7d654cd932b7d11cb604629a2d0.sys - \spwizimgvt.sys - \c94f405c5929cfcccc8ad00b42c95083.sys - \fur.sys - \wantd.sys - \windbg.sys - \4118b86e490aed091b1a219dba45f332.sys - \gmer64.sys - \1fc7aeeff3ab19004d2e53eae8160ab1.sys - \poortry2.sys - \wintapix.sys - \daxin_blank6.sys - \6771b13a53b9c7449d4891e427735ea2.sys - \blacklotus_driver.sys - \air_system10.sys - \dkrtk.sys - \7.sys - \sense5ext.sys - \ktgn.sys - \ndislan.sys - \nlslexicons0024uvn.sys - \be6318413160e589080df02bb3ca6e6a.sys - \4.sys - \wantd_2.sys - \e29f6311ae87542b3d693c1f38e4e3ad.sys - \daxin_blank3.sys - \gftkyj64.sys - \daxin_blank2.sys - \wantd_4.sys - \reddriver.sys - \834761775.sys - \mlgbbiicaihflrnh.sys - \mjj0ge.sys - \daxin_blank.sys - \daxin_blank5.sys - \poortry1.sys - \msqpq.sys - \mimidrv.sys - \e939448b28a4edc81f1f974cebf6e7d2.sys - \prokiller64.sys - \nodedriver.sys - \wantd_3.sys - \lctka.sys - \kapchelper_x64.sys - \daxin_blank4.sys - \a9df5964635ef8bd567ae487c3d214c4.sys - \wantd_6.sys - \ntbios.sys - \wantd_5.sys - \pciecubed.sys - \mimikatz.sys - \nqrmq.sys - \2.sys - \poortry.sys - \ntbios_2.sys - \fgme.sys - \telephonuafy.sys - \typelibde.sys - \daxin_blank1.sys - \ef0e1725aaf0c6c972593f860531a2ea.sys - \5a4fe297c7d42539303137b6d75b150d.sys condition: selection falsepositives: - False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version. - If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible) level: medium