Windows Process Creation: Suspicious Executable Image Extension
Flags Windows process creations where the executable image path ends with an unexpected extension, after filtering known benign cases.
- Product
- windows
- Category
- process_creation
- Author
- Max Altgelt (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-12-09
- Updated
- 2026-07-30
What it detects
Identifies Windows process creation events where the spawned process image does not end with a set of known executable/script extensions (such as .exe, .com, .scr, etc.), excluding multiple common Windows and software paths. This matters because attackers can use process-starting techniques that reference unusual or misleading file types to evade standard execution expectations. The detection relies on process creation telemetry containing the parent and image paths, including special-case exclusions for trusted system and installer-related locations.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Suspicious Executable Image Extension"
id: 6e2febf5-94c7-4461-8824-fd555b25c61e
status: test
description: Identifies Windows process creation events where the spawned process image does not end with a set of known executable/script extensions (such as .exe, .com, .scr, etc.), excluding multiple common Windows and software paths. This matters because attackers can use process-starting techniques that reference unusual or misleading file types to evade standard execution expectations. The detection relies on process creation telemetry containing the parent and image paths, including special-case exclusions for trusted system and installer-related locations.
references:
- https://pentestlaboratories.com/2021/12/08/process-ghosting/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_non_exe_image.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2021-12-09
modified: 2023-11-23
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
known_image_extension:
Image|endswith:
- .bin
- .cgi
- .com
- .exe
- .scr
- .tmp
filter_main_image:
Image:
- System
- Registry
- MemCompression
- vmmem
filter_main_msi_installers:
Image|contains: :\Windows\Installer\MSI
filter_main_driver_store:
Image|contains: :\Windows\System32\DriverStore\FileRepository\
filter_main_msi_rollbackfiles:
Image|contains: :\Config.Msi\
Image|endswith:
- .rbf
- .rbs
filter_main_windows_temp:
- ParentImage|contains: :\Windows\Temp\
- Image|contains: :\Windows\Temp\
filter_main_deleted:
Image|contains: :\$Extend\$Deleted\
filter_main_empty:
Image:
- "-"
- ""
filter_main_null:
Image: null
filter_optional_avira:
ParentImage|contains: :\ProgramData\Avira\
filter_optional_nvidia:
Image|contains: NVIDIA\NvBackend\
Image|endswith: .dat
filter_optional_winpakpro:
Image|contains:
- :\Program Files (x86)\WINPAKPRO\
- :\Program Files\WINPAKPRO\
Image|endswith: .ngn
filter_optional_myq_server:
Image|endswith:
- :\Program Files (x86)\MyQ\Server\pcltool.dll
- :\Program Files\MyQ\Server\pcltool.dll
filter_optional_wsl:
Image|contains|all:
- \AppData\Local\Packages\
- \LocalState\rootfs\
filter_optional_lzma_exe:
Image|endswith: \LZMA_EXE
filter_optional_firefox:
Image|contains: :\Program Files\Mozilla Firefox\
filter_optional_docker:
ParentImage: C:\Windows\System32\services.exe
Image|endswith: com.docker.service
condition: not known_image_extension and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: c09dad97-1c78-4f71-b127-7edb2b8e491a
type: derived