Windows Suspicious File Creation in Fake Recycle.Bin Folder Paths

title: Windows Suspicious File Creation in Fake Recycle.Bin Folder Paths
id: dc82f51e-1414-4cc4-ac64-5a3f33c9ffdf
related:
  - id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0
    type: derived
  - id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca
    type: derived
status: test
description: This rule flags Windows file create/write events where the source image path or the target filename contains common fake Recycle.Bin folder markers (RECYCLERS.BIN\ or RECYCLER.BIN\). Malware and other tooling often use these locations as staging areas to blend in with expected system folder names. It relies on Windows file event telemetry that includes both the process image path and the target filename.
references:
  - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets
  - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-12
modified: 2023-12-11
tags:
  - attack.persistence
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    - Image|contains:
        - RECYCLERS.BIN\
        - RECYCLER.BIN\
    - TargetFilename|contains:
        - RECYCLERS.BIN\
        - RECYCLER.BIN\
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec/info.yml
license: DRL-1.1