huntrule

Windows: Copied suspicious EXE/DLL files into default GPO storage path

Alerts when .exe/.dll files are created in the default GPO storage folder path.

FreeUnreviewedSigmamediumv1
title: "Windows: Copied suspicious EXE/DLL files into default GPO storage path"
id: 21407e48-16da-4a50-b169-1e65004e852f
status: test
description: This rule flags file creation or placement of executable (.exe) and dynamic library (.dll) files into the default Group Policy Objects (GPO) storage folder path identified by the GUID. Adversaries may use GPO file locations to stage or distribute malicious payloads across domain systems for persistence or execution. Detection relies on Windows file event telemetry that includes the target file path/filename for each create or write action.
references:
  - https://redcanary.com/blog/intelligence-insights-november-2021/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_default_gpo_dir_write.yml
author: elhoim, Huntrule Team
date: 2022-04-28
tags:
  - attack.stealth
  - attack.t1036.005
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\
    TargetFilename|endswith:
      - .dll
      - .exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5f87308a-0a5b-4623-ae15-d8fa1809bc60
    type: derived

What it detects

This rule flags file creation or placement of executable (.exe) and dynamic library (.dll) files into the default Group Policy Objects (GPO) storage folder path identified by the GUID. Adversaries may use GPO file locations to stage or distribute malicious payloads across domain systems for persistence or execution. Detection relies on Windows file event telemetry that includes the target file path/filename for each create or write action.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.