Windows Process Creation From Fake Recycle.Bin Directories
Alerts on Windows processes launched from fake RECYCLER.BIN / RECYCLERS.BIN folder paths often used for stealth.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-12
- Updated
- 2026-07-30
What it detects
This rule flags Windows process executions where the process image path contains a Recycle.Bin directory variant such as RECYCLERS.BIN\ or RECYCLER.BIN\. Attackers sometimes use fake recycle bin folders to blend into user-visible paths and evade casual inspection. It relies on Windows process creation telemetry with the recorded Image path content.
Reporting behind it
- mandiant.comhttps://www.mandiant.com/resources/blog/infected-usb-steal-secrets
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_recycle_bin_fake_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-from-fake-recycle-bin-directories-5ce0f04e
title: Windows Process Creation From Fake Recycle.Bin Directories
id: 3afd2ce3-1b14-4ca8-aa29-8c996722555a
related:
- id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca
type: derived
- id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0
type: derived
status: test
description: This rule flags Windows process executions where the process image path contains a Recycle.Bin directory variant such as RECYCLERS.BIN\ or RECYCLER.BIN\. Attackers sometimes use fake recycle bin folders to blend into user-visible paths and evade casual inspection. It relies on Windows process creation telemetry with the recorded Image path content.
references:
- https://www.mandiant.com/resources/blog/infected-usb-steal-secrets
- https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_recycle_bin_fake_execution.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-12
modified: 2023-12-11
tags:
- attack.persistence
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains:
- RECYCLERS.BIN\
- RECYCLER.BIN\
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1