huntrule

Windows: Suspicious Executable Downloads Missing File Metadata Fields

Alerts when a process launches from Downloads with missing/placeholder file metadata (Description, FileVersion, Product, or Company).

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Markus Neis, Sander Wiebing (SigmaHQ), DRL 1.1
Published
2018-11-22
Updated
2026-07-30
AnalysisDetection
title: "Windows: Suspicious Executable Downloads Missing File Metadata Fields"
id: 76c37054-ecc2-46ec-8f05-aa37f6e172e9
status: test
description: This rule flags process creation events where an executable located in the Windows Downloads folder has suspiciously missing file metadata fields (Description, FileVersion, Product, or Company). Attackers may produce or stage executables with incomplete or placeholder metadata to hinder identification and analysis. The detection relies on process creation telemetry that includes the executable path (to contain '\Downloads\') and file metadata fields, matching records where those fields are present but contain the placeholder value '?'.
references:
  - https://securelist.com/muddywater/88059/
  - https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_file_characteristics.yml
author: Markus Neis, Sander Wiebing, Huntrule Team
date: 2018-11-22
modified: 2022-10-09
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  product: windows
  category: process_creation
detection:
  selection1:
    Description: \?
    FileVersion: \?
  selection2:
    Description: \?
    Product: \?
  selection3:
    Description: \?
    Company: \?
  folder:
    Image|contains: \Downloads\
  condition: (selection1 or selection2 or selection3) and folder
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9637e8a5-7131-4f7f-bdc7-2b05d8670c43
    type: derived