Query: Sigma rule for Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW
Matching passage: Sigma rule: Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW. Logsource: windows / file_event. Rule: title: Files With System Process Name In Unsuspected Locations id: d5866ddf-ce8f-4aea-b28e-d96485a20d3d status: test description: 'Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production. ' references: - Internal Research author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2020-05-26 modified: 2026-07-28 tags: - attack.stealth - attack.t1036.005 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \AtBroker.exe - \audiodg.exe - \backgroundTaskHost.exe - \bcdedit.exe - \bitsadmin.exe - \cmdl32.exe - \cmstp.exe - \conhost.exe - \csrss.exe - \dasHost.exe - \dfrgui.exe - \dllhost.exe - \dwm.exe - \eventcreate.exe - \eventvwr.exe - \explorer.exe - \extrac32.exe - \fontdrvhost.exe - \fsquirt.exe - \ipconfig.exe - \iscsicli.exe - \iscsicpl.exe - \logman.exe - \LogonUI.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \msinfo32.exe - \mstsc.exe - \nbtstat.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regini.exe - \regsvr32.exe - \rundll32.exe - \RuntimeBroker.exe - \schtasks.exe - \SearchFilterHost.exe - \SearchIndexer.exe - \SearchProtocolHost.exe - \SecurityHealthService.exe - \SecurityHealthSystray.exe - \services.exe - \ShellAppRuntime.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \SystemSettingsBroker.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \TiWorker.exe - \vssadmin.exe - \w32tm.exe - \WerFault.exe - \WerFaultSecure.exe - \wermgr.exe - \wevtutil.exe - \wininit.exe - \winlogon.exe - \winrshost.exe - \WinRTNetMUAHostServer.exe - \wlanext.exe - \wlrmdr.exe - \WmiPrvSE.exe - \wslhost.exe - \WSReset.exe - \WUDFHost.exe - \WWAHost.exe filter_main_generic: TargetFilename|contains: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\Windows\uus\ filter_main_tiworker: Image|endswith: - \TiWorker.exe - \wuaucltcore.exe TargetFilename|startswith: C:\Windows\Temp\ filter_main_svchost: Image|endswith: - C:\Windows\system32\svchost.exe - C:\Windows\SysWOW64\svchost.exe TargetFilename|contains: - C:\Program Files\WindowsApps\ - C:\Program Files (x86)\WindowsApps\ - \AppData\Local\Microsoft\WindowsApps\ filter_main_wuauclt: Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\Sy
Near-miss passage: Sigma rule: Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercin. Logsource: windows / process_creation. Rule: title: HackTool - ADCSPwn Execution id: cd8c163e-a19b-402e-bdd5-419ff5859f12 status: test description: Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service references: - https://github.com/bats3c/ADCSPwn author: Florian Roth (Nextron Systems) date: 2021-07-31 modified: 2023-02-04 tags: - attack.collection - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' --adcs ' - ' --port ' condition: selection falsepositives: - Unlikely level: high