huntrule

Suspicious SearchApp Masquerading Executed Outside System Directory

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-24
Updated
2026-09-24
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a process named SearchApp.exe running from a location other than the Windows System directories, matching the Webworm EchoCreep implant that impersonates the Windows Search application. The genuine SearchApp.exe executes only from packaged system paths, so a copy running elsewhere exposes the masqueraded malware.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Malicious FrostyNeighbor ViberPC Renamed Rundll32 DLL Execution
Suspicious Windows Terminal Binary Masquerade From ProgramData via Axios npm Compromise
Malicious Contagious Interview RAT via Masqueraded Service Binary in User Path
Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise
Suspicious osascript Spawning Shell Executing Hidden macOS Payload via Axios Compromise
Malicious Masquerading TiWorker Spawning PowerShell Downloader via process_creation
Suspicious Print Filter Pipeline Host Running Outside System32 via Process Creation
Malicious TELEPUZ DLL Persistence via Masqueraded Loader in User Path
Malicious Fseventsd Masquerade in Users Shared Directory via File Event
Suspicious SearchApp Masquerading Executed Outside System Directory
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.