Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)
Flags Windows LOLBIN execution when process CurrentDirectory is not empty/null and contains C:\, indicating unusual launch context.
- Product
- windows
- Category
- process_creation
- Author
- Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman (SigmaHQ), DRL 1.1
- Published
- 2022-01-25
- Updated
- 2026-07-30
What it detects
This rule identifies execution of common Windows LOLBINs (such as calc.exe, certutil.exe, cmstp.exe, cscript.exe, installutil.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe) when their CurrentDirectory is set to an abnormal value. Attackers often use trusted binaries launched from unexpected locations (e.g., mounted media or nonstandard working directories) to hide or blend in. The detection relies on process creation telemetry including Image, OriginalFileName, and CurrentDirectory fields.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2021/12/13/diavol-ransomware/
- scythe.iohttps://www.scythe.io/library/threat-emulation-qakbot
- sec-consult.comhttps://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)
id: 11e1642f-db08-49c2-a915-a8eae0d895b2
related:
- id: 5b80cf53-3a46-4adc-960b-05ec19348d74
type: similar
- id: d4ca7c59-e9e4-42d8-bf57-91a776efcb87
type: derived
status: test
description: This rule identifies execution of common Windows LOLBINs (such as calc.exe, certutil.exe, cmstp.exe, cscript.exe, installutil.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe) when their CurrentDirectory is set to an abnormal value. Attackers often use trusted binaries launched from unexpected locations (e.g., mounted media or nonstandard working directories) to hide or blend in. The detection relies on process creation telemetry including Image, OriginalFileName, and CurrentDirectory fields.
references:
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
- https://www.scythe.io/library/threat-emulation-qakbot
- https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman, Huntrule Team
date: 2022-01-25
modified: 2023-08-29
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- \calc.exe
- \certutil.exe
- \cmstp.exe
- \cscript.exe
- \installutil.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \wscript.exe
- OriginalFileName:
- CALC.EXE
- CertUtil.exe
- CMSTP.EXE
- cscript.exe
- installutil.exe
- MSHTA.EXE
- REGSVR32.EXE
- RUNDLL32.EXE
- wscript.exe
filter_main_currentdirectory:
CurrentDirectory|contains: C:\
filter_main_empty:
CurrentDirectory: ""
filter_main_null:
CurrentDirectory: null
condition: selection and not 1 of filter_main_*
falsepositives:
- Rare false positives could occur on servers with multiple drives.
level: medium
license: DRL-1.1