Windows Network Connections Initiated by Processes in C:\Users\Public
Flags outbound network connections initiated by a process whose image path is under C:\Users\Public on Windows.
- Product
- windows
- Category
- network_connection
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-05-31
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows network connections where the initiating process path contains C:\Users\Public\, indicating execution from a world-writable location. Attackers commonly place payloads in publicly writable directories to increase the chance of successful execution and subsequent command-and-control activity. It relies on Windows network connection telemetry that includes the process image path and whether the connection was initiated.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Network Connections Initiated by Processes in C:\Users\Public
id: 42b8b261-4875-433b-8982-cf95457d1431
related:
- id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
type: derived
- id: bcb03938-9f8b-487d-8d86-e480691e1d71
type: derived
status: test
description: This rule flags Windows network connections where the initiating process path contains C:\Users\Public\, indicating execution from a world-writable location. Attackers commonly place payloads in publicly writable directories to increase the chance of successful execution and subsequent command-and-control activity. It relies on Windows network connection telemetry that includes the process image path and whether the connection was initiated.
references:
- https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_susp_initaited_public_folder.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2024-05-31
tags:
- attack.command-and-control
- attack.t1105
- detection.threat-hunting
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: "true"
Image|contains: :\Users\Public\
filter_optional_ibm:
Image|contains: :\Users\Public\IBM\ClientSolutions\Start_Programs\
condition: selection and not 1 of filter_optional_*
falsepositives:
- Likely from legitimate third party application that execute from the "Public" directory.
level: medium
license: DRL-1.1