Windows File Events: Writing by Executables to Uncommon Locations

title: "Windows File Events: Writing by Executables to Uncommon Locations"
id: 326486f2-9fe3-4bfc-8bc3-395092df61ec
related:
  - id: 2ddef153-167b-4e89-86b6-757a9e65dcac
    type: similar
  - id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67
    type: derived
status: experimental
description: This rule flags Windows file write activity where specific legitimate-looking application executables write any file to uncommon or suspicious target paths. Such behavior is important because adversaries can abuse trusted binaries to stage or download payloads in locations that are atypical for normal application data storage. The detection relies on file event telemetry, matching executable names from the writing process and the target filename path substrings.
references:
  - https://lolbas-project.github.io/#/download
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-10
tags:
  - attack.stealth
  - attack.t1218
  - attack.command-and-control
  - attack.t1105
logsource:
  product: windows
  category: file_event
detection:
  selection_img:
    Image|endswith:
      - \eqnedt32.exe
      - \wordpad.exe
      - \wordview.exe
      - \cmdl32.exe
      - \certutil.exe
      - \certoc.exe
      - \CertReq.exe
      - \bitsadmin.exe
      - \Desktopimgdownldr.exe
      - \esentutl.exe
      - \expand.exe
      - \extrac32.exe
      - \replace.exe
      - \mshta.exe
      - \ftp.exe
      - \Ldifde.exe
      - \RdrCEF.exe
      - \hh.exe
      - \finger.exe
      - \findstr.exe
  selection_locations:
    TargetFilename|contains:
      - :\Perflogs
      - :\ProgramData\
      - :\Temp\
      - :\Users\Public\
      - :\Windows\
      - \$Recycle.Bin\
      - \AppData\Local\
      - \AppData\Roaming\
      - \Contacts\
      - \Desktop\
      - \Favorites\
      - \Favourites\
      - \inetpub\wwwroot\
      - \Music\
      - \Pictures\
      - \Start Menu\Programs\Startup\
      - \Users\Default\
      - \Videos\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/info.yml
license: DRL-1.1