huntrule

Windows: Suspicious Executable Downloads Missing File Metadata Fields

Alerts when a process launches from Downloads with missing/placeholder file metadata (Description, FileVersion, Product, or Company).

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Markus Neis, Sander Wiebing (SigmaHQ), DRL 1.1
Published
2018-11-22
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where an executable located in the Windows Downloads folder has suspiciously missing file metadata fields (Description, FileVersion, Product, or Company). Attackers may produce or stage executables with incomplete or placeholder metadata to hinder identification and analysis. The detection relies on process creation telemetry that includes the executable path (to contain '\Downloads\') and file metadata fields, matching records where those fields are present but contain the placeholder value '?'.

Reporting behind it

Related detections9 linkedT1059.006 — drag to rearrange
Suspicious Python Reverse Shell One-Liner Execution via GlobalProtect Exploitation
Malicious Python Reverse Shell Execution on macOS
Suspicious Python Execution from Windows Store App Path
Possible Trojanised Python Native Extension Load of gradient Module
Malicious AI CLI Anti-Attribution and Permission Bypass Flags
Suspicious Python HTTP Server Staging for Payload Delivery
Suspicious Python Base64 Encoded Command Execution (via process_creation)
Suspicious __init__.py Drop in Public Directory by Slow Pisces (via file_event)
Malicious Python Reverse Shell One-Liner Execution (via process_creation)
Windows: Suspicious Executable Downloads Missing File Metadata Fields
Pivot detection · T1059.006 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.