Query: rule covering Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW
Matching passage: Sigma rule: Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW. Logsource: windows / file_event. Rule: title: Files With System Process Name In Unsuspected Locations id: d5866ddf-ce8f-4aea-b28e-d96485a20d3d status: test description: 'Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production. ' references: - Internal Research author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2020-05-26 modified: 2026-07-28 tags: - attack.stealth - attack.t1036.005 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \AtBroker.exe - \audiodg.exe - \backgroundTaskHost.exe - \bcdedit.exe - \bitsadmin.exe - \cmdl32.exe - \cmstp.exe - \conhost.exe - \csrss.exe - \dasHost.exe - \dfrgui.exe - \dllhost.exe - \dwm.exe - \eventcreate.exe - \eventvwr.exe - \explorer.exe - \extrac32.exe - \fontdrvhost.exe - \fsquirt.exe - \ipconfig.exe - \iscsicli.exe - \iscsicpl.exe - \logman.exe - \LogonUI.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \msinfo32.exe - \mstsc.exe - \nbtstat.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regini.exe - \regsvr32.exe - \rundll32.exe - \RuntimeBroker.exe - \schtasks.exe - \SearchFilterHost.exe - \SearchIndexer.exe - \SearchProtocolHost.exe - \SecurityHealthService.exe - \SecurityHealthSystray.exe - \services.exe - \ShellAppRuntime.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \SystemSettingsBroker.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \TiWorker.exe - \vssadmin.exe - \w32tm.exe - \WerFault.exe - \WerFaultSecure.exe - \wermgr.exe - \wevtutil.exe - \wininit.exe - \winlogon.exe - \winrshost.exe - \WinRTNetMUAHostServer.exe - \wlanext.exe - \wlrmdr.exe - \WmiPrvSE.exe - \wslhost.exe - \WSReset.exe - \WUDFHost.exe - \WWAHost.exe filter_main_generic: TargetFilename|contains: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\Windows\uus\ filter_main_tiworker: Image|endswith: - \TiWorker.exe - \wuaucltcore.exe TargetFilename|startswith: C:\Windows\Temp\ filter_main_svchost: Image|endswith: - C:\Windows\system32\svchost.exe - C:\Windows\SysWOW64\svchost.exe TargetFilename|contains: - C:\Program Files\WindowsApps\ - C:\Program Files (x86)\WindowsApps\ - \AppData\Local\Microsoft\WindowsApps\ filter_main_wuauclt: Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\Sy
Near-miss passage: Sigma rule: Detects suspicious service installation commands. Logsource: windows / system. Rule: title: Suspicious Service Installation id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 26481afe-db26-4228-b264-25a29fe6efc7 type: similar status: test description: Detects suspicious service installation commands references: - Internal Research author: pH-T (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2023-12-04 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - ' -nop ' - ' -sta ' - ' -w hidden ' - :\Temp\ - .downloadfile( - .downloadstring( - \ADMIN$\ - \Perflogs\ - '&&' condition: selection falsepositives: - Unknown level: high