huntrule

Windows Process Command Lines Writing Malicious Files to C:\Windows\Fonts

Flags Windows command lines that create or copy files into C:\Windows\Fonts\ using suspicious file extensions.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Sreeman (SigmaHQ), DRL 1.1
Published
2020-04-21
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule looks for process command lines that include both operations consistent with creating/copying files (e.g., echo, copy, type, file createnew, cacls) and a target path under C:\Windows\Fonts\. It further restricts matches to command lines referencing common executable or script file extensions. Writing to the Fonts directory can support persistence or execution by placing attacker-controlled files in a trusted system location, and the detection relies on Windows process creation telemetry with command-line visibility.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange
AutoIt Script Execution via A3X Payload
Suspicious Python Execution via Renamed Synaptics Binary
Suspicious Dell ControlVault DLL Load by Unexpected Process (ReVault)
Suspicious Vulnerable ASUS AsIO3.sys Driver Load
MSBuild Executing Non-Project File or Remote Payload
Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)
Possible Craft CMS RCE via Query-String CLI Option Injection
Possible Aspera Faspex Pre-Auth RCE via YAML Deserialization in package_relay (via webserver)
Possible Sitecore Pre-Auth RCE via Report.ashx Insecure Deserialization (via webserver)
Windows Process Command Lines Writing Malicious Files to C:\Windows\Fonts
Pivot detection · T1059 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.