Windows Process Execution: Copy From System Directories to Other Locations

Detects cmd.exe, PowerShell, and copy utilities copying files from System32/SysWOW64/WinSxS to other locations on disk.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2020-07-03
Updated: 2026-07-30

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.003Rename Legitimate Utilities
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process executions where cmd.exe, PowerShell, or common copy utilities attempt to copy from Windows system locations such as System32, SysWOW64, or WinSxS to another on-disk path. Such behavior can be used to stage or relocate legitimate binaries (including utilities) under a different name or location to evade controls based on expected paths. It relies on process creation telemetry, matching command-line text and the image name/path against copy-related patterns and system-directory target paths, with an exclusion for a specific Avira-related command sequence.

Reporting behind it

Related detections9 linkedT1036.003 — drag to rearrange

Suspicious Renamed Tunneling Tool Executing from Windows Tasks Directory

Suspicious Renamed PowerShell Binary Execution (via process_creation)

Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe

Suspicious Renamed PowerShell Copied from System32 via Batch Loader

Suspicious Renamed PowerShell Binary Execution (via process_creation)

Renamed Autohotkey Binary

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Renamed Execution of a Renamed Windows System Utility (via process_creation)

Windows Process Execution: Copy From System Directories to Other Locations

Pivot detection · T1036.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-copy-from-system-directories-to-other-locations-fff9d2b7

title: "Windows Process Execution: Copy From System Directories to Other Locations"
id: 0d6addf1-b687-4601-a0df-c911d965ede6
related:
  - id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900
    type: derived
  - id: fff9d2b7-e11c-4a69-93d3-40ef66189767
    type: derived
status: test
description: This rule flags Windows process executions where cmd.exe, PowerShell, or common copy utilities attempt to copy from Windows system locations such as System32, SysWOW64, or WinSxS to another on-disk path. Such behavior can be used to stage or relocate legitimate binaries (including utilities) under a different name or location to evade controls based on expected paths. It relies on process creation telemetry, matching command-line text and the image name/path against copy-related patterns and system-directory target paths, with an exclusion for a specific Avira-related command sequence.
references:
  - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
  - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml
author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-07-03
modified: 2026-03-16
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains: "copy "
  selection_img_pwsh:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - copy-item
      - " copy "
      - "cpi "
      - " cp "
  selection_img_other:
    - Image|endswith:
        - \robocopy.exe
        - \xcopy.exe
    - OriginalFileName:
        - robocopy.exe
        - XCOPY.EXE
  selection_target:
    CommandLine|re|i: \s['"]?C:\\Windows\\(?:System32|SysWOW64|WinSxS)
  filter_optional_avira:
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - /c copy
      - \Temp\
      - \avira_system_speedup.exe
    CommandLine|contains:
      - C:\Program Files\Avira\
      - C:\Program Files (x86)\Avira\
  condition: 1 of selection_img_* and selection_target and not 1 of filter_optional_*
falsepositives:
  - Depend on scripts and administrative tools used in the monitored environment (For example an admin scripts like https://www.itexperience.net/sccm-batch-files-and-32-bits-processes-on-64-bits-os/)
  - When cmd.exe and xcopy.exe are called directly
  - When the command contains the keywords but not in the correct order
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL