Query: write Sigma for Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW
Matching passage: Sigma rule: Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW. Logsource: windows / file_event. Rule: title: Files With System Process Name In Unsuspected Locations id: d5866ddf-ce8f-4aea-b28e-d96485a20d3d status: test description: 'Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production. ' references: - Internal Research author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2020-05-26 modified: 2026-07-28 tags: - attack.stealth - attack.t1036.005 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \AtBroker.exe - \audiodg.exe - \backgroundTaskHost.exe - \bcdedit.exe - \bitsadmin.exe - \cmdl32.exe - \cmstp.exe - \conhost.exe - \csrss.exe - \dasHost.exe - \dfrgui.exe - \dllhost.exe - \dwm.exe - \eventcreate.exe - \eventvwr.exe - \explorer.exe - \extrac32.exe - \fontdrvhost.exe - \fsquirt.exe - \ipconfig.exe - \iscsicli.exe - \iscsicpl.exe - \logman.exe - \LogonUI.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \msinfo32.exe - \mstsc.exe - \nbtstat.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regini.exe - \regsvr32.exe - \rundll32.exe - \RuntimeBroker.exe - \schtasks.exe - \SearchFilterHost.exe - \SearchIndexer.exe - \SearchProtocolHost.exe - \SecurityHealthService.exe - \SecurityHealthSystray.exe - \services.exe - \ShellAppRuntime.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \SystemSettingsBroker.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \TiWorker.exe - \vssadmin.exe - \w32tm.exe - \WerFault.exe - \WerFaultSecure.exe - \wermgr.exe - \wevtutil.exe - \wininit.exe - \winlogon.exe - \winrshost.exe - \WinRTNetMUAHostServer.exe - \wlanext.exe - \wlrmdr.exe - \WmiPrvSE.exe - \wslhost.exe - \WSReset.exe - \WUDFHost.exe - \WWAHost.exe filter_main_generic: TargetFilename|contains: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\Windows\uus\ filter_main_tiworker: Image|endswith: - \TiWorker.exe - \wuaucltcore.exe TargetFilename|startswith: C:\Windows\Temp\ filter_main_svchost: Image|endswith: - C:\Windows\system32\svchost.exe - C:\Windows\SysWOW64\svchost.exe TargetFilename|contains: - C:\Program Files\WindowsApps\ - C:\Program Files (x86)\WindowsApps\ - \AppData\Local\Microsoft\WindowsApps\ filter_main_wuauclt: Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\Sy
Near-miss passage: Sigma rule: Alerts on trust record modification within the registry, indicating usage of macros. Logsource: windows / registry_event. Rule: title: Windows Registry Trust Record Modification id: 295a59c1-7b79-4b47-a930-df12c15fc9c2 related: - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd type: similar status: test description: Alerts on trust record modification within the registry, indicating usage of macros references: - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html - https://twitter.com/inversecos/status/1494174785621819397 author: Antonlovesdnb, Trent Liffick (@tliffick) date: 2020-02-19 modified: 2023-06-21 tags: - attack.initial-access - attack.t1566.001 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Security\Trusted Documents\TrustRecords condition: selection falsepositives: - This will alert on legitimate macro usage as well, additional tuning is required level: medium