Windows Publisher Attachment File Created in Suspicious Directory

Alerts on creation of .pub files in Temp/Public-like directories on Windows where staging is likely.

FreeUnreviewedSigmamediumv1

windows-publisher-attachment-file-created-in-suspicious-directory-3d2a2d59

title: Windows Publisher Attachment File Created in Suspicious Directory
id: dfe6401e-94b8-4751-a271-d33c8b987c7f
status: test
description: This rule flags file creation events where a filename ending with .pub is written to commonly abused temporary or public directories. .pub files in these locations can be used to stage or persist malicious content when delivered via Publisher document workflows. It relies on Windows file event telemetry capturing the created file path (TargetFilename).
references:
  - https://twitter.com/EmericNasi/status/1623224526220804098
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_publisher_files_in_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
tags:
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - \AppData\Local\Temp\
      - \Users\Public\
      - \Windows\Temp\
      - C:\Temp\
    TargetFilename|endswith: .pub
  condition: selection
falsepositives:
  - Legitimate usage of ".pub" files from those locations
level: medium
license: DRL-1.1
related:
  - id: 3d2a2d59-929c-4b78-8c1a-145dfe9e07b1
    type: derived

What it detects

This rule flags file creation events where a filename ending with .pub is written to commonly abused temporary or public directories. .pub files in these locations can be used to stage or persist malicious content when delivered via Publisher document workflows. It relies on Windows file event telemetry capturing the created file path (TargetFilename).

Known false positives

Legitimate usage of ".pub" files from those locations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.