Windows Public Folder File Creation With Suspicious Script or Binary Extensions

Alerts on Windows file creation in \Users\Public\ with potentially malicious script/binary extensions.

FreeUnreviewedSigmahighv1

windows-public-folder-file-creation-with-suspicious-script-or-binary-extensions-b447f7de

title: Windows Public Folder File Creation With Suspicious Script or Binary Extensions
id: bc7bb988-6da9-48d0-8222-fdfbdae2859e
status: experimental
description: This rule flags file creation events where the target path contains :\Users\Public\ and the filename ends with extensions commonly used for scripts, executables, and script hosts. Attackers often place or stage payloads in public directories to reduce access barriers and increase the chance of user interaction or execution. The detection relies on Windows file event telemetry that includes the created file path (TargetFilename).
references:
  - https://intel.thedfirreport.com/events/view/30032
  - https://intel.thedfirreport.com/eventReports/view/70
  - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_public_folder_extension.yml
author: The DFIR Report, Huntrule Team
date: 2025-01-23
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: :\Users\Public\
    TargetFilename|endswith:
      - .bat
      - .dll
      - .exe
      - .hta
      - .js
      - .ps1
      - .vbe
      - .vbs
  condition: selection
falsepositives:
  - Administrators deploying legitimate binaries to public folders.
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_public_folder_extension/info.yml
license: DRL-1.1
related:
  - id: b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e
    type: derived

What it detects

This rule flags file creation events where the target path contains :\Users\Public\ and the filename ends with extensions commonly used for scripts, executables, and script hosts. Attackers often place or stage payloads in public directories to reduce access barriers and increase the chance of user interaction or execution. The detection relies on Windows file event telemetry that includes the created file path (TargetFilename).

Known false positives

Administrators deploying legitimate binaries to public folders.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.