Windows Masqueraded System Binaries Executed from Non-Default Paths (msdtc.exe, gpsvc.exe)

title: Windows Masqueraded System Binaries Executed from Non-Default Paths (msdtc.exe, gpsvc.exe)
id: ec044cc3-0698-47c6-b027-a764c7b4160a
status: test
description: This rule flags Windows process executions where the binary filename ends with msdtc.exe or gpsvc.exe, but the executable path does not begin with the default System32 or SysWOW64 directories. Masquerading legitimate-looking system binaries from non-standard locations is a common stealth tactic to evade casual inspection and some allowlists. The detection relies on process creation telemetry, matching executable path patterns via the Image field.
references:
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180244/Lazarus_Under_The_Hood_PDF_final.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Lazarus/proc_creation_win_apt_lazarus_binary_masquerading.yml
author: Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1), Huntrule Team
date: 2020-06-03
modified: 2023-03-10
tags:
  - attack.stealth
  - attack.t1036.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \msdtc.exe
      - \gpsvc.exe
  filter:
    Image|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
    type: derived