Windows Network Connection From Process in C:\Users\Public Folder

Flags outbound network connections initiated by a process whose image path is under C:\Users\Public on Windows.

FreeUnreviewedSigmamediumv1

windows-network-connection-from-process-in-c-users-public-folder-bcb03938

title: Windows Network Connection From Process in C:\Users\Public Folder
id: 42b8b261-4875-433b-8982-cf95457d1431
related:
  - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
    type: derived
  - id: bcb03938-9f8b-487d-8d86-e480691e1d71
    type: derived
status: test
description: This rule identifies network connections initiated by processes running from the C:\Users\Public directory. Attackers often abuse this universally writable location to stage payloads, making outbound connections from there a useful signal for suspicious command-and-control activity. The detection relies on Windows network connection telemetry and the initiating process image path containing the Users\Public folder.
references:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_susp_initaited_public_folder.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2024-05-31
tags:
  - attack.command-and-control
  - attack.t1105
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|contains: :\Users\Public\
  filter_optional_ibm:
    Image|contains: :\Users\Public\IBM\ClientSolutions\Start_Programs\
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Likely from legitimate third party application that execute from the "Public" directory.
level: medium
license: DRL-1.1

What it detects

This rule identifies network connections initiated by processes running from the C:\Users\Public directory. Attackers often abuse this universally writable location to stage payloads, making outbound connections from there a useful signal for suspicious command-and-control activity. The detection relies on Windows network connection telemetry and the initiating process image path containing the Users\Public folder.

Known false positives

Likely from legitimate third party application that execute from the "Public" directory.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.