Windows File Creation: ProgramData Persistence Artifacts Matching
Alerts on Windows file creations in C:\ProgramData matching specific driver inf, .dll, and batch/script filename patterns.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-04-23
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file creation events where the target filename is under C:\ProgramData\ and matches specific patterns associated with driver-store style entries or named payload artifacts. Such activity is notable because attackers may drop or stage executables and scripts in commonly writable locations like ProgramData to support persistence or post-compromise tooling. It relies on file event telemetry that includes the full target filename/path and matches it using prefix, suffix, and substring conditions.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_activity.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Creation: ProgramData Persistence Artifacts Matching"
id: 62062b5b-00fe-4f37-9a1a-ca4e00eda8c4
status: test
description: This rule flags Windows file creation events where the target filename is under C:\ProgramData\ and matches specific patterns associated with driver-store style entries or named payload artifacts. Such activity is notable because attackers may drop or stage executables and scripts in commonly writable locations like ProgramData to support persistence or post-compromise tooling. It relies on file event telemetry that includes the full target filename/path and matches it using prefix, suffix, and substring conditions.
references:
- https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-23
modified: 2024-07-11
tags:
- attack.defense-impairment
- attack.t1685.001
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection_programdata_driver_store:
TargetFilename|startswith:
- C:\ProgramData\Microsoft\v
- C:\ProgramData\Adobe\v
- C:\ProgramData\Comms\v
- C:\ProgramData\Intel\v
- C:\ProgramData\Kaspersky Lab\v
- C:\ProgramData\Bitdefender\v
- C:\ProgramData\ESET\v
- C:\ProgramData\NVIDIA\v
- C:\ProgramData\UbiSoft\v
- C:\ProgramData\Steam\v
TargetFilename|contains:
- \prnms003.inf_
- \prnms009.inf_
selection_programdata_main:
TargetFilename|startswith: C:\ProgramData\
selection_programdata_files_1:
TargetFilename|endswith:
- .save
- \doit.bat
- \execute.bat
- \servtask.bat
selection_programdata_files_2:
TargetFilename|contains: \wayzgoose
TargetFilename|endswith: .dll
condition: selection_programdata_driver_store or (selection_programdata_main and 1 of selection_programdata_files_*)
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: b92d1d19-f5c9-4ed6-bbd5-7476709dc389
type: derived