Windows Process Creation: Suspicious Executable Image Extension

title: "Windows Process Creation: Suspicious Executable Image Extension"
id: 6e2febf5-94c7-4461-8824-fd555b25c61e
status: test
description: Identifies Windows process creation events where the spawned process image does not end with a set of known executable/script extensions (such as .exe, .com, .scr, etc.), excluding multiple common Windows and software paths. This matters because attackers can use process-starting techniques that reference unusual or misleading file types to evade standard execution expectations. The detection relies on process creation telemetry containing the parent and image paths, including special-case exclusions for trusted system and installer-related locations.
references:
  - https://pentestlaboratories.com/2021/12/08/process-ghosting/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_non_exe_image.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2021-12-09
modified: 2023-11-23
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  known_image_extension:
    Image|endswith:
      - .bin
      - .cgi
      - .com
      - .exe
      - .scr
      - .tmp
  filter_main_image:
    Image:
      - System
      - Registry
      - MemCompression
      - vmmem
  filter_main_msi_installers:
    Image|contains: :\Windows\Installer\MSI
  filter_main_driver_store:
    Image|contains: :\Windows\System32\DriverStore\FileRepository\
  filter_main_msi_rollbackfiles:
    Image|contains: :\Config.Msi\
    Image|endswith:
      - .rbf
      - .rbs
  filter_main_windows_temp:
    - ParentImage|contains: :\Windows\Temp\
    - Image|contains: :\Windows\Temp\
  filter_main_deleted:
    Image|contains: :\$Extend\$Deleted\
  filter_main_empty:
    Image:
      - "-"
      - ""
  filter_main_null:
    Image: null
  filter_optional_avira:
    ParentImage|contains: :\ProgramData\Avira\
  filter_optional_nvidia:
    Image|contains: NVIDIA\NvBackend\
    Image|endswith: .dat
  filter_optional_winpakpro:
    Image|contains:
      - :\Program Files (x86)\WINPAKPRO\
      - :\Program Files\WINPAKPRO\
    Image|endswith: .ngn
  filter_optional_myq_server:
    Image|endswith:
      - :\Program Files (x86)\MyQ\Server\pcltool.dll
      - :\Program Files\MyQ\Server\pcltool.dll
  filter_optional_wsl:
    Image|contains|all:
      - \AppData\Local\Packages\
      - \LocalState\rootfs\
  filter_optional_lzma_exe:
    Image|endswith: \LZMA_EXE
  filter_optional_firefox:
    Image|contains: :\Program Files\Mozilla Firefox\
  filter_optional_docker:
    ParentImage: C:\Windows\System32\services.exe
    Image|endswith: com.docker.service
  condition: not known_image_extension and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c09dad97-1c78-4f71-b127-7edb2b8e491a
    type: derived