Windows Process Execution: Copy From System Directories to Other Locations

title: "Windows Process Execution: Copy From System Directories to Other Locations"
id: 0d6addf1-b687-4601-a0df-c911d965ede6
related:
  - id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900
    type: derived
  - id: fff9d2b7-e11c-4a69-93d3-40ef66189767
    type: derived
status: test
description: This rule flags Windows process executions where cmd.exe, PowerShell, or common copy utilities attempt to copy from Windows system locations such as System32, SysWOW64, or WinSxS to another on-disk path. Such behavior can be used to stage or relocate legitimate binaries (including utilities) under a different name or location to evade controls based on expected paths. It relies on process creation telemetry, matching command-line text and the image name/path against copy-related patterns and system-directory target paths, with an exclusion for a specific Avira-related command sequence.
references:
  - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
  - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml
author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-07-03
modified: 2026-03-16
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains: "copy "
  selection_img_pwsh:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - copy-item
      - " copy "
      - "cpi "
      - " cp "
  selection_img_other:
    - Image|endswith:
        - \robocopy.exe
        - \xcopy.exe
    - OriginalFileName:
        - robocopy.exe
        - XCOPY.EXE
  selection_target:
    CommandLine|re|i: \s['"]?C:\\Windows\\(?:System32|SysWOW64|WinSxS)
  filter_optional_avira:
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - /c copy
      - \Temp\
      - \avira_system_speedup.exe
    CommandLine|contains:
      - C:\Program Files\Avira\
      - C:\Program Files (x86)\Avira\
  condition: 1 of selection_img_* and selection_target and not 1 of filter_optional_*
falsepositives:
  - Depend on scripts and administrative tools used in the monitored environment (For example an admin scripts like https://www.itexperience.net/sccm-batch-files-and-32-bits-processes-on-64-bits-os/)
  - When cmd.exe and xcopy.exe are called directly
  - When the command contains the keywords but not in the correct order
level: medium
license: DRL-1.1