Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools

title: Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools
id: 206a58eb-b8b8-41c4-8fca-14f59cc66c3a
related:
  - id: fff9d2b7-e11c-4a69-93d3-40ef66189767
    type: derived
  - id: f5d19838-41b5-476c-98d8-ba8af4929ee2
    type: derived
status: test
description: Identifies process activity where cmd.exe, PowerShell, or common copy utilities are used to copy a known LOLBIN from Windows system locations such as System32, SysWOW64, or WinSxS to another location on disk. This matters because copying signed/included Windows binaries is a common stealth technique to run attacker-controlled code while attempting to bypass detection rules that rely on expected file paths. The rule relies on process creation telemetry, matching the invoking binary, the copy-related command content, and the presence of system directory and LOLBIN names in the command line.
references:
  - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
  - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-29
modified: 2025-11-27
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains: "copy "
  selection_tools_pwsh:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - copy-item
      - " copy "
      - "cpi "
      - " cp "
  selection_tools_other:
    - Image|endswith:
        - \robocopy.exe
        - \xcopy.exe
    - OriginalFileName:
        - robocopy.exe
        - XCOPY.EXE
  selection_target_path:
    CommandLine|contains:
      - \System32
      - \SysWOW64
      - \WinSxS
  selection_target_lolbin:
    CommandLine|contains:
      - \bitsadmin.exe
      - \calc.exe
      - \certutil.exe
      - \cmdl32.exe
      - \cscript.exe
      - \mshta.exe
      - \rundll32.exe
      - \wscript.exe
      - \ie4uinit.exe
  condition: 1 of selection_tools_* and all of selection_target_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1