huntrule

Suspicious Executable Launched from PerfLogs Directory by Estate Ransomware

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-26
Updated
2026-09-26
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects executables running from the C:\PerfLogs directory, an unusual location abused by Estate Ransomware to stage the LB3 LockBit payload. PsExec deploys the binary here to evade attention on the endpoint. Execution from PerfLogs is anomalous and strongly suggests malicious staging.

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange
Malicious Renamed Python Interpreter svchostc Executing Script (via process_creation)
Suspicious Scripting Interpreter Execution From Downloads Or Temp via Reputation Hijacking
Suspicious MMC Console Loading MSC File From User Writable Path
Suspicious EAGERBEE Configuration File Created in Public User Directory via File Event
Malicious DLL Execution With Non Standard Extension via rundll32
Suspicious Rclone Exfiltration Masquerading as wininit.exe
Suspicious Executable Running from Public Pictures Directory
Suspicious Python Execution via Renamed Synaptics Binary
Agent Tesla Persistence via Realtek Named Scheduled Task Batch
Suspicious Executable Launched from PerfLogs Directory by Estate Ransomware
Pivot detection · T1036 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.