Suspicious WinSxS Executable File Creation By Non-System Process (via file_event)

title: Suspicious WinSxS Executable File Creation By Non-System Process (via file_event)
id: 41754228-4f0c-533e-b021-b93ce6607ccc
status: stable
description: This rule detects the creation of binaries in the WinSxS folder by non-system processes
references:
    - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
author: Huntrule Team
date: 2026-06-23
tags:
    - attack.execution
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Windows\WinSxS\'
        TargetFilename|endswith: '.exe'
    filter_main_system_location:
        Image|startswith:
            - 'C:\Windows\Systems32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
    filter_hr:
        Image|endswith: \servicing\TrustedInstaller.exe
    condition: (selection and not 1 of filter_main_*) and not filter_hr
falsepositives:
    - Unknown
level: medium