Windows: File creation of C:\Windows\System32\wpbbin.exe for UEFI persistence indicators

Flags creation of C:\Windows\System32\wpbbin.exe, a potential UEFI persistence artifact.

FreeUnreviewedSigmahighv1

windows-file-creation-of-c-windows-system32-wpbbin-exe-for-uefi-persistence-indi-e94b9ddc

title: "Windows: File creation of C:\\Windows\\System32\\wpbbin.exe for UEFI persistence indicators"
id: 628ecead-027d-418a-b5cf-1f4e70843922
status: test
description: This rule identifies creation events for the file C:\Windows\System32\wpbbin.exe. Attackers may use this specific artifact as part of UEFI-based persistence mechanisms, so spotting its appearance can indicate unauthorized boot persistence attempts. The detection relies on Windows file event telemetry that records the target file path for newly created files.
references:
  - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
  - https://persistence-info.github.io/Data/wpbbin.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_wpbbin_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-18
tags:
  - attack.persistence
  - attack.stealth
  - attack.t1542.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename: C:\Windows\System32\wpbbin.exe
  condition: selection
falsepositives:
  - Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip)
level: high
license: DRL-1.1
related:
  - id: e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f
    type: derived

What it detects

This rule identifies creation events for the file C:\Windows\System32\wpbbin.exe. Attackers may use this specific artifact as part of UEFI-based persistence mechanisms, so spotting its appearance can indicate unauthorized boot persistence attempts. The detection relies on Windows file event telemetry that records the target file path for newly created files.

Known false positives

Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.