Query: write Sigma for Detects suspicious new RUN key element pointing to an executable in a suspicious folder
Matching passage: Sigma rule: Detects suspicious new RUN key element pointing to an executable in a suspicious folder. Logsource: windows / registry_set. Rule: title: New RUN Key Pointing to Suspicious Folder id: 02ee49e2-e294-4d0f-9278-f5b3212fc588 status: experimental description: Detects suspicious new RUN key element pointing to an executable in a suspicious folder references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2018-08-25 modified: 2025-10-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run selection_suspicious_paths_1: Details|contains: - :\Perflogs - :\ProgramData' - :\Windows\Temp - :\Temp - \AppData\Local\Temp - \AppData\Roaming - :\$Recycle.bin - :\Users\Default - :\Users\public - '%temp%' - '%tmp%' - '%Public%' - '%AppData%' selection_suspicious_paths_user_1: Details|contains: :\Users\ selection_suspicious_paths_user_2: Details|contains: - \Favorites - \Favourites - \Contacts - \Music - \Pictures - \Documents - \Photos filter_main_windows_update: TargetObject|contains: \Microsoft\Windows\CurrentVersion\RunOnce\ Image|startswith: C:\Windows\SoftwareDistribution\Download\ Details|contains|all: - 'rundll32.exe ' - C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 Details|contains: - \AppData\Local\Temp\ - C:\Windows\Temp\ filter_optional_spotify: Image|endswith: - C:\Program Files\Spotify\Spotify.exe - C:\Program Files (x86)\Spotify\Spotify.exe - \AppData\Roaming\Spotify\Spotify.exe TargetObject|endswith: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify Details|endswith: Spotify.exe --autostart --minimized condition: selection_target and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_* )) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Software using weird folders for updates level: high
Near-miss passage: Sigma rule: Detects usage of bitsadmin downloading a file using an URL that contains an IP. Logsource: windows / process_creation. Rule: title: Suspicious Download From Direct IP Via Bitsadmin id: 99c840f2-2012-46fd-9141-c761987550ef related: - id: 90f138c1-f578-4ac3-8c49-eecfd847c8b7 type: similar status: test description: Detects usage of bitsadmin downloading a file using an URL that contains an IP references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ author: Florian Roth (Nextron Systems) date: 2022-06-28 modified: 2023-02-15 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_flags: CommandLine|contains: - ' /transfer ' - ' /create ' - ' /addfile ' selection_extension: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 filter_seven_zip: CommandLine|contains: ://7- condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip/info.yml