Windows Process Execution From Uncommon or Sensitive Directories

title: Windows Process Execution From Uncommon or Sensitive Directories
id: 9f517daf-9754-43c6-811e-2b11e9bea08c
status: test
description: This rule flags Windows process creation where the executed image path contains indicators of less-common, sensitive, or attacker-prone directories (for example Perflogs, multiple Users subfolders, Windows tasks/addins/debug/Fonts/Media/repair/security, Recycle bin, systemprofile config, Intel Logs, and RSA MachineKeys). Attackers may place or execute binaries from these locations to evade user scrutiny and blend into system activity. The detection relies on process creation telemetry with access to the full Image path and matches on substring/path patterns, with optional exclusions for specific IBM and Citrix paths and binaries.
references:
  - https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt
  - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
  - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
  - https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Huntrule Team
date: 2019-01-16
modified: 2024-07-12
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - :\Perflogs\
      - :\Users\All Users\
      - :\Users\Default\
      - :\Users\NetworkService\
      - :\Windows\addins\
      - :\Windows\debug\
      - :\Windows\Fonts\
      - :\Windows\Help\
      - :\Windows\IME\
      - :\Windows\Media\
      - :\Windows\repair\
      - :\Windows\security\
      - :\Windows\System32\Tasks\
      - :\Windows\Tasks\
      - $Recycle.bin
      - \config\systemprofile\
      - \Intel\Logs\
      - \RSA\MachineKeys\
  filter_optional_ibm:
    Image|startswith: C:\Users\Public\IBM\ClientSolutions\Start_Programs\
  filter_optional_citrix:
    Image|startswith: C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\
    Image|endswith: \CitrixReceiverUpdater.exe
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4
    type: derived