Windows file creation: System process executables in non-system locations

title: "Windows file creation: System process executables in non-system locations"
id: 3cb1f029-54d8-440d-a5cf-068288d96be3
status: test
description: This rule flags Windows file creation events where the created executable filename ends with a list of common system process names (for example, lsass.exe, svchost.exe, powershell.exe), but the file is written outside typical system directories. This matters because attackers may masquerade as legitimate system binaries by copying or dropping executables into unusual paths. It relies on file creation telemetry including the target filename and related path and, in some cases, the creating image path, filtered to reduce expected locations.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_system_file.yml
author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-05-26
modified: 2026-07-28
tags:
  - attack.stealth
  - attack.t1036.005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - \AtBroker.exe
      - \audiodg.exe
      - \backgroundTaskHost.exe
      - \bcdedit.exe
      - \bitsadmin.exe
      - \cmdl32.exe
      - \cmstp.exe
      - \conhost.exe
      - \csrss.exe
      - \dasHost.exe
      - \dfrgui.exe
      - \dllhost.exe
      - \dwm.exe
      - \eventcreate.exe
      - \eventvwr.exe
      - \explorer.exe
      - \extrac32.exe
      - \fontdrvhost.exe
      - \fsquirt.exe
      - \ipconfig.exe
      - \iscsicli.exe
      - \iscsicpl.exe
      - \logman.exe
      - \LogonUI.exe
      - \LsaIso.exe
      - \lsass.exe
      - \lsm.exe
      - \msiexec.exe
      - \msinfo32.exe
      - \mstsc.exe
      - \nbtstat.exe
      - \odbcconf.exe
      - \powershell.exe
      - \pwsh.exe
      - \regini.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \RuntimeBroker.exe
      - \schtasks.exe
      - \SearchFilterHost.exe
      - \SearchIndexer.exe
      - \SearchProtocolHost.exe
      - \SecurityHealthService.exe
      - \SecurityHealthSystray.exe
      - \services.exe
      - \ShellAppRuntime.exe
      - \sihost.exe
      - \smartscreen.exe
      - \smss.exe
      - \spoolsv.exe
      - \svchost.exe
      - \SystemSettingsBroker.exe
      - \taskhost.exe
      - \taskhostw.exe
      - \Taskmgr.exe
      - \TiWorker.exe
      - \vssadmin.exe
      - \w32tm.exe
      - \WerFault.exe
      - \WerFaultSecure.exe
      - \wermgr.exe
      - \wevtutil.exe
      - \wininit.exe
      - \winlogon.exe
      - \winrshost.exe
      - \WinRTNetMUAHostServer.exe
      - \wlanext.exe
      - \wlrmdr.exe
      - \WmiPrvSE.exe
      - \wslhost.exe
      - \WSReset.exe
      - \WUDFHost.exe
      - \WWAHost.exe
  filter_main_generic:
    TargetFilename|contains:
      - C:\$WINDOWS.~BT\
      - C:\$WinREAgent\
      - C:\Windows\SoftwareDistribution\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
      - C:\Windows\uus\
  filter_main_tiworker:
    Image|endswith:
      - \TiWorker.exe
      - \wuaucltcore.exe
    TargetFilename|startswith: C:\Windows\Temp\
  filter_main_svchost:
    Image|endswith:
      - C:\Windows\system32\svchost.exe
      - C:\Windows\SysWOW64\svchost.exe
    TargetFilename|contains:
      - C:\Program Files\WindowsApps\
      - C:\Program Files (x86)\WindowsApps\
      - \AppData\Local\Microsoft\WindowsApps\
  filter_main_wuauclt:
    Image:
      - C:\Windows\System32\wuauclt.exe
      - C:\Windows\SysWOW64\wuauclt.exe
      - C:\Windows\UUS\arm64\wuaucltcore.exe
  filter_main_explorer:
    TargetFilename|endswith: C:\Windows\explorer.exe
  filter_main_msiexec:
    Image|endswith:
      - C:\WINDOWS\system32\msiexec.exe
      - C:\WINDOWS\SysWOW64\msiexec.exe
    TargetFilename|startswith:
      - C:\Program Files\PowerShell\7\pwsh.exe
      - C:\Program Files\PowerShell\7-preview\pwsh.exe
      - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview\
  filter_main_healtray:
    TargetFilename|contains: C:\Windows\System32\SecurityHealth\
    TargetFilename|endswith: \SecurityHealthSystray.exe
    Image|endswith: \SecurityHealthSetup.exe
  filter_optional_wslhost:
    - TargetFilename: C:\Program Files\WSL\wslhost.exe
    - TargetFilename|contains|all:
        - C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_
        - \wslhost.exe
    - TargetFilename|contains|all:
        - C:\Users\
        - \AppData\Local\Microsoft\WindowsApps\
        - \wslhost.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - System processes copied outside their default folders for testing purposes
  - Third party software naming their software with the same names as the processes mentioned here
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_file/info.yml
license: DRL-1.1
related:
  - id: d5866ddf-ce8f-4aea-b28e-d96485a20d3d
    type: derived