Windows Suspicious Executable File Creation via Malicious Filenames and Extensions

Alerts on Windows file creation with suspicious executable filename patterns, including .bat.exe/.sys.exe and deceptive path-based names.

FreeUnreviewedSigmahighv1

windows-suspicious-executable-file-creation-via-malicious-filenames-and-extensio-74babdd6

title: Windows Suspicious Executable File Creation via Malicious Filenames and Extensions
id: 4ab7973b-71a7-4e1d-9fe9-04c5813c3e04
status: test
description: This rule flags Windows file creation events where the target filename matches specific suspicious patterns, including filenames ending in .bat.exe and .sys.exe, as well as executable names placed in paths typical of abuse scenarios (e.g., in $Recycle.Bin.exe or Documents and Settings.exe). Attackers commonly use misleading or crafted filenames to masquerade as legitimate files and trick users or services into executing attacker-controlled binaries. The detection relies on Windows file event telemetry that records the created target filename and supports suffix matching.
references:
  - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
  - https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_executable_creation.yml
author: frack113, Huntrule Team
date: 2022-09-05
modified: 2023-12-11
tags:
  - attack.stealth
  - attack.t1564
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - :\$Recycle.Bin.exe
      - :\Documents and Settings.exe
      - :\MSOCache.exe
      - :\PerfLogs.exe
      - :\Recovery.exe
      - .bat.exe
      - .sys.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 74babdd6-a758-4549-9632-26535279e654
    type: derived

What it detects

This rule flags Windows file creation events where the target filename matches specific suspicious patterns, including filenames ending in .bat.exe and .sys.exe, as well as executable names placed in paths typical of abuse scenarios (e.g., in $Recycle.Bin.exe or Documents and Settings.exe). Attackers commonly use misleading or crafted filenames to masquerade as legitimate files and trick users or services into executing attacker-controlled binaries. The detection relies on Windows file event telemetry that records the created target filename and supports suffix matching.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.