Windows File Events: java.exe in AppData\Roaming\Oracle\bin Path with .exe and .vbs Artifacts
Alerts on Windows file events for suspicious java*.exe placement in AppData\Roaming\Oracle\bin and .vbs files containing "Retrive".
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2017-11-10
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Windows file creation or access events where a target filename contains a specific AppData\Roaming\Oracle\bin java-related path ending in .exe, as well as filenames containing the string "Retrive" and a .vbs extension. Such artifacts are commonly used by malware droppers to stage executables and accompanying script files in user-writable directories. It relies on file_event telemetry that includes the full or partial TargetFilename for the relevant file paths and extensions.
Reporting behind it
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
- first.orghttps://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_mal_adwind.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Events: java.exe in AppData\\Roaming\\Oracle\\bin Path with .exe and .vbs Artifacts"
id: e038db78-9a00-4f8a-8469-f5ce082b34d7
related:
- id: 1fac1481-2dbc-48b2-9096-753c49b4ec71
type: derived
- id: 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
type: derived
status: test
description: This rule matches Windows file creation or access events where a target filename contains a specific AppData\Roaming\Oracle\bin java-related path ending in .exe, as well as filenames containing the string "Retrive" and a .vbs extension. Such artifacts are commonly used by malware droppers to stage executables and accompanying script files in user-writable directories. It relies on file_event telemetry that includes the full or partial TargetFilename for the relevant file paths and extensions.
references:
- https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
- https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_mal_adwind.yml
author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2017-11-10
modified: 2022-12-02
tags:
- attack.execution
- attack.t1059.005
- attack.t1059.007
logsource:
category: file_event
product: windows
detection:
selection:
- TargetFilename|contains|all:
- \AppData\Roaming\Oracle\bin\java
- .exe
- TargetFilename|contains|all:
- \Retrive
- .vbs
condition: selection
level: high
license: DRL-1.1