huntrule

Windows Process Command Lines Writing Malicious Files to C:\Windows\Fonts

Flags Windows command lines that create or copy files into C:\Windows\Fonts\ using suspicious file extensions.

FreeUnreviewedSigmamediumv1
title: Windows Process Command Lines Writing Malicious Files to C:\Windows\Fonts
id: 7a4391f5-9f1a-49a4-a068-88dd690e05e0
status: test
description: This rule looks for process command lines that include both operations consistent with creating/copying files (e.g., echo, copy, type, file createnew, cacls) and a target path under C:\Windows\Fonts\. It further restricts matches to command lines referencing common executable or script file extensions. Writing to the Fonts directory can support persistence or execution by placing attacker-controlled files in a trusted system location, and the detection relies on Windows process creation telemetry with command-line visibility.
references:
  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml
author: Sreeman, Huntrule Team
date: 2020-04-21
modified: 2022-03-08
tags:
  - attack.stealth
  - attack.t1211
  - attack.t1059
  - attack.persistence
  - attack.execution
logsource:
  product: windows
  category: process_creation
detection:
  selection_1:
    CommandLine|contains:
      - echo
      - copy
      - type
      - file createnew
      - cacls
  selection_2:
    CommandLine|contains: C:\Windows\Fonts\
  selection_3:
    CommandLine|contains:
      - .sh
      - .exe
      - .dll
      - .bin
      - .bat
      - .cmd
      - .js
      - .msh
      - .reg
      - .scr
      - .ps
      - .vb
      - .jar
      - .pl
      - ".inf"
      - .cpl
      - .hta
      - .msi
      - .vbs
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ae9b0bd7-8888-4606-b444-0ed7410cb728
    type: derived

What it detects

This rule looks for process command lines that include both operations consistent with creating/copying files (e.g., echo, copy, type, file createnew, cacls) and a target path under C:\Windows\Fonts\. It further restricts matches to command lines referencing common executable or script file extensions. Writing to the Fonts directory can support persistence or execution by placing attacker-controlled files in a trusted system location, and the detection relies on Windows process creation telemetry with command-line visibility.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.