Windows File Events: Suspicious Executable File Name Creation

Alerts on Windows file creation with suspicious executable filename patterns, including .bat.exe/.sys.exe and deceptive path-based names.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-09-05
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564Hide Artifacts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows file creation events where the target filename ends with specific suspicious executable-related patterns. Attackers often leverage masquerading or misleading extensions (e.g., .bat.exe, .sys.exe) and may attempt to drop executables into paths associated with common privilege escalation or persistence techniques using crafted filename strings. The detection relies on Windows file event telemetry that includes the target filename for the create operation.

Reporting behind it

Related detections9 linkedT1564 — drag to rearrange

Suspicious Windows Security Spoofing via pin Executable Writing output.txt via process_creation

Obfuscated Extended Rights Backdoor Obfuscation - Via localizationDisplayId Attribute (via security)

Suspicious Process Execution from Public User Media Folders via process_creation

Suspicious Windows Sandbox Configuration Execution for AsyncRAT via Process Creation

System Informer Execution on Windows Process Creation

Linux mount executed with hidepid=2 option

Windows Process Hacker Execution Identified by Image Metadata and Hashes

Windows: Suspicious Parent Process Execution From \Users\Public Spawning Scripting/Shell Binaries

Windows Registry: Disable CrashDump via CrashControl DWORD value

Windows File Events: Suspicious Executable File Name Creation

Pivot detection · T1564 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-executable-file-creation-via-malicious-filenames-and-extensio-74babdd6

title: "Windows File Events: Suspicious Executable File Name Creation"
id: 4ab7973b-71a7-4e1d-9fe9-04c5813c3e04
status: test
description: This rule matches Windows file creation events where the target filename ends with specific suspicious executable-related patterns. Attackers often leverage masquerading or misleading extensions (e.g., .bat.exe, .sys.exe) and may attempt to drop executables into paths associated with common privilege escalation or persistence techniques using crafted filename strings. The detection relies on Windows file event telemetry that includes the target filename for the create operation.
references:
  - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
  - https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_executable_creation.yml
author: frack113, Huntrule Team
date: 2022-09-05
modified: 2023-12-11
tags:
  - attack.stealth
  - attack.t1564
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - :\$Recycle.Bin.exe
      - :\Documents and Settings.exe
      - :\MSOCache.exe
      - :\PerfLogs.exe
      - :\Recovery.exe
      - .bat.exe
      - .sys.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 74babdd6-a758-4549-9632-26535279e654
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL