Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools

Flags cmd/PowerShell/robocopy/xcopy commands that copy known LOLBINs out of System32/SysWOW64/WinSxS.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-08-29
Updated: 2026-07-30

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.003Rename Legitimate Utilities
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies process activity where cmd.exe, PowerShell, or common copy utilities are used to copy a known LOLBIN from Windows system locations such as System32, SysWOW64, or WinSxS to another location on disk. This matters because copying signed/included Windows binaries is a common stealth technique to run attacker-controlled code while attempting to bypass detection rules that rely on expected file paths. The rule relies on process creation telemetry, matching the invoking binary, the copy-related command content, and the presence of system directory and LOLBIN names in the command line.

Reporting behind it

Related detections9 linkedT1036.003 — drag to rearrange

Renamed Autohotkey Binary

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Renamed Execution of a Renamed Windows System Utility (via process_creation)

Suspicious Renamed Pythonw Interpreter Execution via XWorm Loader (via process_creation)

Suspicious PowerShell Masquerading as Windows Terminal via process_creation

Windows Schtasks Execution with Renamed schtasks.exe Binary

Windows RMM Tool MeshAgent Execution with Renamed MeshServiceName

macOS Process Creation: MeshAgent renamed execution via --meshServiceName

Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools

Pivot detection · T1036.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-lolbin-copy-from-windows-system-directories-using-windows-copy-tools-f5d19838

title: Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools
id: 206a58eb-b8b8-41c4-8fca-14f59cc66c3a
related:
  - id: fff9d2b7-e11c-4a69-93d3-40ef66189767
    type: derived
  - id: f5d19838-41b5-476c-98d8-ba8af4929ee2
    type: derived
status: test
description: Identifies process activity where cmd.exe, PowerShell, or common copy utilities are used to copy a known LOLBIN from Windows system locations such as System32, SysWOW64, or WinSxS to another location on disk. This matters because copying signed/included Windows binaries is a common stealth technique to run attacker-controlled code while attempting to bypass detection rules that rely on expected file paths. The rule relies on process creation telemetry, matching the invoking binary, the copy-related command content, and the presence of system directory and LOLBIN names in the command line.
references:
  - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
  - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-29
modified: 2025-11-27
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains: "copy "
  selection_tools_pwsh:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - copy-item
      - " copy "
      - "cpi "
      - " cp "
  selection_tools_other:
    - Image|endswith:
        - \robocopy.exe
        - \xcopy.exe
    - OriginalFileName:
        - robocopy.exe
        - XCOPY.EXE
  selection_target_path:
    CommandLine|contains:
      - \System32
      - \SysWOW64
      - \WinSxS
  selection_target_lolbin:
    CommandLine|contains:
      - \bitsadmin.exe
      - \calc.exe
      - \certutil.exe
      - \cmdl32.exe
      - \cscript.exe
      - \mshta.exe
      - \rundll32.exe
      - \wscript.exe
      - \ie4uinit.exe
  condition: 1 of selection_tools_* and all of selection_target_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL