huntrule

Windows Process Creation From Fake Recycle.Bin Directories

Alerts on Windows processes launched from fake RECYCLER.BIN / RECYCLERS.BIN folder paths often used for stealth.

FreeUnreviewedSigmahighv1
title: Windows Process Creation From Fake Recycle.Bin Directories
id: 3afd2ce3-1b14-4ca8-aa29-8c996722555a
related:
  - id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca
    type: derived
  - id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0
    type: derived
status: test
description: This rule flags Windows process executions where the process image path contains a Recycle.Bin directory variant such as RECYCLERS.BIN\ or RECYCLER.BIN\. Attackers sometimes use fake recycle bin folders to blend into user-visible paths and evade casual inspection. It relies on Windows process creation telemetry with the recorded Image path content.
references:
  - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets
  - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_recycle_bin_fake_execution.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-12
modified: 2023-12-11
tags:
  - attack.persistence
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - RECYCLERS.BIN\
      - RECYCLER.BIN\
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags Windows process executions where the process image path contains a Recycle.Bin directory variant such as RECYCLERS.BIN\ or RECYCLER.BIN\. Attackers sometimes use fake recycle bin folders to blend into user-visible paths and evade casual inspection. It relies on Windows process creation telemetry with the recorded Image path content.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.