Windows: Suspicious File Creation in Fake RECYCLER.BIN Staging Folders
Alerts on Windows file writes involving RECYCLERS.BIN\ or RECYCLER.BIN\ paths often used for staging.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_event
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-12
- Updated
- 2026-07-31
What it detects
This rule flags file create/write events where either the process image path or the target filename contains a fake RECYCLER.BIN directory reference (including RECYCLERS.BIN\ and RECYCLER.BIN\). Attackers may use these deceptive folders to stage payloads while blending in with expected recycle-bin naming. Telemetry relies on Windows file event logs providing the originating Image and the TargetFilename fields.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-file-creation-in-fake-recycle-bin-folder-paths-cd8b36ac
title: "Windows: Suspicious File Creation in Fake RECYCLER.BIN Staging Folders"
id: dc82f51e-1414-4cc4-ac64-5a3f33c9ffdf
related:
- id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0
type: derived
- id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca
type: derived
status: test
description: This rule flags file create/write events where either the process image path or the target filename contains a fake RECYCLER.BIN directory reference (including RECYCLERS.BIN\ and RECYCLER.BIN\). Attackers may use these deceptive folders to stage payloads while blending in with expected recycle-bin naming. Telemetry relies on Windows file event logs providing the originating Image and the TargetFilename fields.
references:
- https://www.mandiant.com/resources/blog/infected-usb-steal-secrets
- https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-12
modified: 2023-12-11
tags:
- attack.persistence
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
- Image|contains:
- RECYCLERS.BIN\
- RECYCLER.BIN\
- TargetFilename|contains:
- RECYCLERS.BIN\
- RECYCLER.BIN\
condition: selection
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec/info.yml
license: DRL-1.1