Windows Scripting Binaries Writing Files to Suspicious Directories

title: Windows Scripting Binaries Writing Files to Suspicious Directories
id: e101da0b-8587-454b-b54a-bc1add48d366
status: test
description: This rule flags file write events where a Windows shell or scripting binary (e.g., cmd.exe, PowerShell, wscript/cscript, mshta, schtasks, wmic, certutil) writes to paths commonly used for staging or abuse. Attackers frequently leverage legitimate scripting tools to drop or stage payloads in writable or low-monitoring directories to evade controls. The detection relies on Windows file event telemetry that includes the writing process image and the target file path.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_shell_write_susp_directory.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-20
modified: 2023-03-29
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: file_event
  product: windows
detection:
  selection_1:
    Image|endswith:
      - \bash.exe
      - \cmd.exe
      - \cscript.exe
      - \msbuild.exe
      - \powershell.exe
      - \pwsh.exe
      - \sh.exe
      - \wscript.exe
    TargetFilename|startswith:
      - C:\PerfLogs\
      - C:\Users\Public\
  selection_2:
    Image|endswith:
      - \certutil.exe
      - \forfiles.exe
      - \mshta.exe
      - \schtasks.exe
      - \scriptrunner.exe
      - \wmic.exe
    TargetFilename|contains:
      - C:\PerfLogs\
      - C:\Users\Public\
      - C:\Windows\Temp\
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1277f594-a7d1-4f28-a2d3-73af5cbeab43
    type: derived