Windows Process Execution From Uncommon or Sensitive Directories
Alerts on process executions from uncommon/sensitive Windows directories, excluding specific IBM and Citrix updater paths.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Tim Shelton (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where the executed image path contains indicators of less-common, sensitive, or attacker-prone directories (for example Perflogs, multiple Users subfolders, Windows tasks/addins/debug/Fonts/Media/repair/security, Recycle bin, systemprofile config, Intel Logs, and RSA MachineKeys). Attackers may place or execute binaries from these locations to evade user scrutiny and blend into system activity. The detection relies on process creation telemetry with access to the full Image path and matches on substring/path patterns, with optional exclusions for specific IBM and Citrix paths and binaries.
Reporting behind it
- github.comhttps://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt
- secureworks.comhttps://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
- crowdstrike.comhttps://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
- github.comhttps://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution From Uncommon or Sensitive Directories
id: 9f517daf-9754-43c6-811e-2b11e9bea08c
status: test
description: This rule flags Windows process creation where the executed image path contains indicators of less-common, sensitive, or attacker-prone directories (for example Perflogs, multiple Users subfolders, Windows tasks/addins/debug/Fonts/Media/repair/security, Recycle bin, systemprofile config, Intel Logs, and RSA MachineKeys). Attackers may place or execute binaries from these locations to evade user scrutiny and blend into system activity. The detection relies on process creation telemetry with access to the full Image path and matches on substring/path patterns, with optional exclusions for specific IBM and Citrix paths and binaries.
references:
- https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt
- https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
- https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Huntrule Team
date: 2019-01-16
modified: 2024-07-12
tags:
- attack.stealth
- attack.t1036
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains:
- :\Perflogs\
- :\Users\All Users\
- :\Users\Default\
- :\Users\NetworkService\
- :\Windows\addins\
- :\Windows\debug\
- :\Windows\Fonts\
- :\Windows\Help\
- :\Windows\IME\
- :\Windows\Media\
- :\Windows\repair\
- :\Windows\security\
- :\Windows\System32\Tasks\
- :\Windows\Tasks\
- $Recycle.bin
- \config\systemprofile\
- \Intel\Logs\
- \RSA\MachineKeys\
filter_optional_ibm:
Image|startswith: C:\Users\Public\IBM\ClientSolutions\Start_Programs\
filter_optional_citrix:
Image|startswith: C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\
Image|endswith: \CitrixReceiverUpdater.exe
condition: selection and not 1 of filter_optional_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4
type: derived