Windows: Suspicious Executable/Archive File Created in C:\PerfLogs\

Alerts on creation of potentially malicious file types in C:\PerfLogs\ on Windows.

FreeUnreviewedSigmamediumv1

windows-suspicious-executable-archive-file-created-in-c-perflogs-bbb7e38c

title: "Windows: Suspicious Executable/Archive File Created in C:\\PerfLogs\\"
id: 119c344f-04d7-4c1d-be07-d868ac9020bb
status: test
description: This rule flags file creation events where the target path is under C:\PerfLogs\ and the filename ends with extensions commonly used for executables, scripts, shortcuts, and archives. Attackers may use this location to stage malicious payloads under a directory that can appear benign. It relies on Windows file event telemetry that provides the created file path or target filename for pattern matching.
references:
  - Internal Research
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_perflogs_susp_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\PerfLogs\
    TargetFilename|endswith:
      - .7z
      - .bat
      - .bin
      - .chm
      - .dll
      - .exe
      - .hta
      - .lnk
      - .ps1
      - .psm1
      - .py
      - .scr
      - .sys
      - .vbe
      - .vbs
      - .zip
  condition: selection
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: bbb7e38c-0b41-4a11-b306-d2a457b7ac2b
    type: derived

What it detects

This rule flags file creation events where the target path is under C:\PerfLogs\ and the filename ends with extensions commonly used for executables, scripts, shortcuts, and archives. Attackers may use this location to stage malicious payloads under a directory that can appear benign. It relies on Windows file event telemetry that provides the created file path or target filename for pattern matching.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.