Windows: .pub File Creation in Temp or Public Directories
Alerts on creation of .pub files in Temp/Public-like directories on Windows where staging is likely.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-08
- Updated
- 2026-07-31
What it detects
Identifies file creation events where a target filename ends with .pub and is placed in common staging locations such as AppData\Local\Temp, Users\Public, Windows\Temp, or C:\Temp. Attackers may use these locations to drop auxiliary payloads or decoy artifacts packaged in publisher-related document flows. The rule relies on Windows file event telemetry that records the created file path and name.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-publisher-attachment-file-created-in-suspicious-directory-3d2a2d59
title: "Windows: .pub File Creation in Temp or Public Directories"
id: dfe6401e-94b8-4751-a271-d33c8b987c7f
status: test
description: Identifies file creation events where a target filename ends with .pub and is placed in common staging locations such as AppData\Local\Temp, Users\Public, Windows\Temp, or C:\Temp. Attackers may use these locations to drop auxiliary payloads or decoy artifacts packaged in publisher-related document flows. The rule relies on Windows file event telemetry that records the created file path and name.
references:
- https://twitter.com/EmericNasi/status/1623224526220804098
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_publisher_files_in_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
tags:
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \AppData\Local\Temp\
- \Users\Public\
- \Windows\Temp\
- C:\Temp\
TargetFilename|endswith: .pub
condition: selection
falsepositives:
- Legitimate usage of ".pub" files from those locations
level: medium
license: DRL-1.1
related:
- id: 3d2a2d59-929c-4b78-8c1a-145dfe9e07b1
type: derived