huntrule

Windows: Suspicious Executable Downloads Missing File Metadata Fields

Alerts when a process launches from Downloads with missing/placeholder file metadata (Description, FileVersion, Product, or Company).

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Markus Neis, Sander Wiebing (SigmaHQ), DRL 1.1
Published
2018-11-22
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where an executable located in the Windows Downloads folder has suspiciously missing file metadata fields (Description, FileVersion, Product, or Company). Attackers may produce or stage executables with incomplete or placeholder metadata to hinder identification and analysis. The detection relies on process creation telemetry that includes the executable path (to contain '\Downloads\') and file metadata fields, matching records where those fields are present but contain the placeholder value '?'.

Reporting behind it

Related detections9 linkedT1059.006 — drag to rearrange
Suspicious Child Process Spawned by Python Interpreter via Process Creation
Suspicious Kimsuky Python Backdoor Staging in Winii Directory (via file_event)
SynkLoader Python Stager Execution from AppData via pythonw (via process_creation)
Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)
Suspicious Python Startup .pth File Creation for Interpreter Persistence
AteraAgent malicious installations
Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)
Malicious InvisibleFerret Python Loader Execution from Hidden .pyp Directory
StealC Loader Execution via Blender Spawning Script Interpreter (via process_creation)
Windows: Suspicious Executable Downloads Missing File Metadata Fields
Pivot detection · T1059.006 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.