Query: write Sigma for Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.
Matching passage: Sigma rule: Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.. Logsource: windows / process_creation. Rule: title: System File Execution Location Anomaly id: e4a6b256-3e47-40fc-89d2-7a477edd6915 related: - id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd type: derived status: test description: 'Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location. ' references: - https://twitter.com/GelosSnake/status/934900723426439170 - https://asec.ahnlab.com/en/39828/ - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2017-11-27 modified: 2026-07-28 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \atbroker.exe - \audiodg.exe - \bcdedit.exe - \bitsadmin.exe - \certreq.exe - \certutil.exe - \cmstp.exe - \conhost.exe - \consent.exe - \cscript.exe - \csrss.exe - \dashost.exe - \defrag.exe - \dfrgui.exe - \dism.exe - \dllhost.exe - \dllhst3g.exe - \dwm.exe - \eventvwr.exe - \fsquirt.exe - \finger.exe - \logonui.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \ntoskrnl.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \runonce.exe - \RuntimeBroker.exe - \schtasks.exe - \services.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \userinit.exe - \werfault.exe - \werfaultsecure.exe - \wininit.exe - \winlogon.exe - \winver.exe - \wlanext.exe - \wmic.exe - \wscript.exe - \wsl.exe - \wsmprovhost.exe filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_optional_system32: Image|contains: \SystemRoot\System32\ filter_main_powershell: Image|contains: - C:\Program Files\PowerShell\7\ - C:\Program Files\PowerShell\7-preview\ - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_wsl_programfiles: Image|startswith: - C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux - C:\Program Files\WSL\ Image|endswith: \wsl.exe filter_main_wsl_appdata: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\WindowsApps\ Image|endswith: \wsl.exe c
Near-miss passage: Sigma rule: Detects instances where an RDP service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - RDP New Connection Attempt id: 598290cf-5932-45cd-9123-be1e05ab4f2e status: experimental description: Detects instances where an RDP service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.initial-access - attack.lateral-movement - attack.persistence - attack.t1133 - attack.t1021.001 logsource: category: application product: opencanary detection: selection: logtype: 14001 condition: selection falsepositives: - Unlikely level: high