Windows Suspicious File Creation in C:\PerfLogs with Executable/Script Extensions

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059Command and Scripting Interpreter
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation events where the target path starts with C:\PerfLogs\ and the filename ends with a list of executable or script-related extensions. Attackers may use this directory to stage or drop payloads where it blends with existing logging/performance artifacts. The detection relies on Windows file event telemetry that records the created file path and extension.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

Suspicious Python Execution via Renamed Synaptics Binary

MSBuild Executing Non-Project File or Remote Payload

Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)

Possible Craft CMS RCE via Query-String CLI Option Injection

Possible Aspera Faspex Pre-Auth RCE via YAML Deserialization in package_relay (via webserver)

Possible Sitecore Pre-Auth RCE via Report.ashx Insecure Deserialization (via webserver)

Possible WatchGuard Pre-Auth RCE via agent login XML-RPC CVE-2022-26318

Possible Oracle Opera CGI Webshell Command Execution via operabin

Suspicious tar Extraction of Staged Archive to Temp (via process_creation)

Windows Suspicious File Creation in C:\PerfLogs with Executable/Script Extensions

Pivot detection · T1059 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-executable-archive-file-created-in-c-perflogs-bbb7e38c

title: Windows Suspicious File Creation in C:\PerfLogs with Executable/Script Extensions
id: 119c344f-04d7-4c1d-be07-d868ac9020bb
status: test
description: This rule flags file creation events where the target path starts with C:\PerfLogs\ and the filename ends with a list of executable or script-related extensions. Attackers may use this directory to stage or drop payloads where it blends with existing logging/performance artifacts. The detection relies on Windows file event telemetry that records the created file path and extension.
references:
  - Internal Research
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_perflogs_susp_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\PerfLogs\
    TargetFilename|endswith:
      - .7z
      - .bat
      - .bin
      - .chm
      - .dll
      - .exe
      - .hta
      - .lnk
      - .ps1
      - .psm1
      - .py
      - .scr
      - .sys
      - .vbe
      - .vbs
      - .zip
  condition: selection
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: bbb7e38c-0b41-4a11-b306-d2a457b7ac2b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL