Windows File Write by Common Executables to Uncommon Locations

Alerts when selected Windows binaries write files to typically uncommon directories such as Temp, ProgramData, AppData, or system areas.

FreeReviewedSigma · High · v4

Product: windows
Category: file_event
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-12-10
Updated: 2026-10-19

Analysis Detection

ATT&CK techniques

Defense Evasion → C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule identifies file events where specific Windows executables (including common Office components and LOLBIN-style downloaders) write any file into locations that are atypical for normal application storage, such as system paths, Temp, ProgramData, user profile directories, and startup-related folders. Attackers may abuse trusted binaries to drop payloads or downloaded files into these areas to blend in with legitimate activity and evade simpler detection. It relies on Windows file event telemetry, matching both the writing process image name and the target filename path contents.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Suspicious File Download via certutil urlcache

Windows Process Access: Suspicious WebDAV target execution via iediagcmd.exe or CustomShellHost.exe (CVE-2025-33053)

Windows Process Creation: Possible CVE-2025-33053 WebDAV RCE via utility search-order manipulation

Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

macOS chflags Hidden Flag Set via chflags hidden parameter

Windows Process Execution: Suspicious cmd.exe Command-Line Combinations (Pikabot-like)

Windows: Detect Ldifde.exe LDAP import (-i -f) usage

Windows findstr.exe Subfolder and Case-Insensitive Search Flags

Windows File Write by Common Executables to Uncommon Locations

Pivot detection · T1105 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-10-19
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-events-writing-by-executables-to-uncommon-locations-1cf465a1

title: Windows File Write by Common Executables to Uncommon Locations
id: 326486f2-9fe3-4bfc-8bc3-395092df61ec
related:
  - id: 2ddef153-167b-4e89-86b6-757a9e65dcac
    type: similar
  - id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67
    type: derived
status: experimental
description: This rule identifies file events where specific Windows executables (including common Office components and LOLBIN-style downloaders) write any file into locations that are atypical for normal application storage, such as system paths, Temp, ProgramData, user profile directories, and startup-related folders. Attackers may abuse trusted binaries to drop payloads or downloaded files into these areas to blend in with legitimate activity and evade simpler detection. It relies on Windows file event telemetry, matching both the writing process image name and the target filename path contents.
references:
  - https://lolbas-project.github.io/#/download
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-10
modified: 2026-10-14
tags:
  - attack.stealth
  - attack.t1218
  - attack.command-and-control
  - attack.t1105
logsource:
  product: windows
  category: file_event
detection:
  selection_img:
    Image|endswith:
      - \eqnedt32.exe
      - \wordpad.exe
      - \wordview.exe
      - \cmdl32.exe
      - \certutil.exe
      - \certoc.exe
      - \CertReq.exe
      - \bitsadmin.exe
      - \Desktopimgdownldr.exe
      - \esentutl.exe
      - \expand.exe
      - \extrac32.exe
      - \replace.exe
      - \mshta.exe
      - \ftp.exe
      - \Ldifde.exe
      - \RdrCEF.exe
      - \hh.exe
      - \finger.exe
      - \findstr.exe
  selection_locations:
    TargetFilename|contains:
      - :\Perflogs
      - :\ProgramData\
      - :\Temp\
      - :\Users\Public\
      - :\Windows\
      - \$Recycle.Bin\
      - \AppData\Local\
      - \AppData\Roaming\
      - \Contacts\
      - \Desktop\
      - \Favorites\
      - \Favourites\
      - \inetpub\wwwroot\
      - \Music\
      - \Pictures\
      - \Start Menu\Programs\Startup\
      - \Users\Default\
      - \Videos\
  filter_optional_dell_techhub_repair:
    Image|endswith: \esentutl.exe
    TargetFilename|startswith:
      - C:\Windows\System32\SRUDB_
      - C:\Windows\System32\TEMPREPAIR
    TargetFilename|endswith:
      - .INTEG.RAW
      - .EDB
  filter_optional_dell_techhub_copy:
    Image|endswith: \esentutl.exe
    TargetFilename|startswith: C:\ProgramData\Dell\DTP\DB\SRUDBData\
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL