Query: Sigma rule for Detects a potentially suspicious execution from an uncommon folder.
Matching passage: Sigma rule: Detects a potentially suspicious execution from an uncommon folder.. Logsource: windows / process_creation. Rule: title: Process Execution From A Potentially Suspicious Folder id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4 status: test description: Detects a potentially suspicious execution from an uncommon folder. references: - https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ - https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md author: Florian Roth (Nextron Systems), Tim Shelton date: 2019-01-16 modified: 2024-07-12 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Perflogs\ - :\Users\All Users\ - :\Users\Default\ - :\Users\NetworkService\ - :\Windows\addins\ - :\Windows\debug\ - :\Windows\Fonts\ - :\Windows\Help\ - :\Windows\IME\ - :\Windows\Media\ - :\Windows\repair\ - :\Windows\security\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - $Recycle.bin - \config\systemprofile\ - \Intel\Logs\ - \RSA\MachineKeys\ filter_optional_ibm: Image|startswith: C:\Users\Public\IBM\ClientSolutions\Start_Programs\ filter_optional_citrix: Image|startswith: C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\ Image|endswith: \CitrixReceiverUpdater.exe condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the load of known vulnerable drivers via the file name of the drivers.. Logsource: windows / driver_load. Rule: title: Vulnerable Driver Load By Name id: 72cd00d6-490c-4650-86ff-1d11f491daa1 status: test description: Detects the load of known vulnerable drivers via the file name of the drivers. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-03 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: ImageLoaded|endswith: - \panmonfltx64.sys - \dbutil.sys - \fairplaykd.sys - \nvaudio.sys - \superbmc.sys - \bsmi.sys - \smarteio64.sys - \bwrsh.sys - \agent64.sys - \asmmap64.sys - \dellbios.sys - \chaos-rootkit.sys - \wcpu.sys - \dh_kernel.sys - \sbiosio64.sys - \bw.sys - \asrdrv102.sys - \nt6.sys - \mhyprot3.sys - \winio64c.sys - \asupio64.sys - \blackbonedrv10.sys - \d.sys - \driver7-x86.sys - \sfdrvx32.sys - \enetechio64.sys - \gdrv.sys - \sysinfodetectorx64.sys - \fh-ethercat_dio.sys - \asromgdrv.sys - \my.sys - \dcprotect.sys - \irec.sys - \gedevdrv.sys - \winio32a.sys - \gvcidrv64.sys - \winio32.sys - \bs_hwmio64.sys - \nstr.sys - \inpoutx64.sys - \hw.sys - \winio64.sys - \hpportiox64.sys - \iobitunlocker.sys - \b1.sys - \aoddriver.sys - \elbycdio.sys - \protects.sys - \kprocesshacker.sys - \speedfan.sys - \radhwmgr.sys - \iscflashx64.sys - \black.sys - \b4.sys - \hwos2ec10x64.sys - \winflash64.sys - \corsairllaccess64.sys - \bs_i2cio.sys - \d3.sys - \windows-xp-64.sys - \aswvmm.sys - \bs_i2c64.sys - \1.sys - \nchgbios2x64.sys - \cpuz141.sys - \segwindrvx64.sys - \tdeio64.sys - \ntiolib.sys - \gtckmdfbs.sys - \iomap64.sys - \avalueio.sys - \semav6msr.sys - \lgdcatcher.sys - \b.sys - \hwdetectng.sys - \nt4.sys - \tgsafe.sys - \mydrivers.sys - \eneio64.sys - \procexp.sys - \viragt64.sys - \fpcie2com.sys - \lenovodiagnosticsdriver.sys - \cp2x72c.sys - \kerneld.amd64 - \bs_def64.sys - \piddrv.sys - \amifldrv64.sys - \cpuz_x64.sys - \proxy32.sys - \wsdkd.sys - \t8.sys - \ucorew64.sys - \atszio.sys - \lmiinfo.sys - \80.sys - \nt3.sys - \ngiodriver.sys - \lv561av.sys - \gpcidrv64.sys - \fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys - \rtport.sys - \full.sys - \viragt.sys - \fiddrv64.sys - \cupfixerx64.sys - \cpupress.sys - \hwos2ec7x64.sys - \driver7-x86-withoutdbg.sys - \asrdrv10.sys - \nvflsh64.sys - \asrrapidstartdrv.sys - \tmcomm.sys - \wiseunlo.sys - \rwdrv.sys - \asio64.sys - \nvoclock.sys - \panio.sys - \mtcbsv64.sys - \amigendrv64.sys - \capcom.sys - \netflt.sys - \phlashnt.sys - \dbut